2.1 Explain the Function of Cloud NGFWs, PA-Series, CN-Series, and VM-Series Firewalls (e.g., Perimeter and Core Security, Zone Security and Segmentation, High Availability [HA], Security and NAT Policy Implementation, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A managed service provider (MSP) hosts a multi-tenant environment on VMware vSphere. Each tenant requires isolated east-west traffic inspection between their application tiers, but the MSP wants to avoid deploying a separate firewall appliance per tenant. The solution must support per-tenant security policies that can be managed centrally by the MSP's security team. Which firewall deployment should the MSP choose?

   • ADeploy a VM-Series firewall in each tenant's virtual network and manage them individually.
   • BDeploy a CN-Series firewall in a Kubernetes cluster running on vSphere.
   • CDeploy a single VM-Series firewall with multiple virtual systems (vsys) to segment tenant traffic.
   • DDeploy a PA-Series firewall in the physical network and route all tenant traffic through it.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is migrating its production workloads to AWS and wants to inspect all inbound traffic to its VPCs without deploying or managing firewall instances. The security team requires centralized policy management and integration with AWS CloudWatch for monitoring. Which solution meets these requirements?

   • ASubscribe to Cloud NGFW for AWS and attach it to the VPCs, managing policies via Panorama.
   • BUse a PA-Series firewall on-premises and create a VPN tunnel to the VPCs.
   • CDeploy a VM-Series firewall in each VPC and configure it to send logs to CloudWatch.
   • DUse AWS Network Firewall and manage policies through AWS Firewall Manager.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network administrator is configuring a PA-Series firewall for a new office. The office has three network segments: users (10.0.1.0/24), servers (10.0.2.0/24), and a guest Wi-Fi network (10.0.3.0/24). The administrator wants to allow users to access the servers, but block guests from accessing the servers and users. Which configuration approach should be used?

   • ACreate a single security policy that allows all traffic between all zones.
   • BConfigure VLANs on the firewall and use inter-VLAN routing to control traffic.
   • CUse a single zone for all segments and rely on IP-based rules in the security policy.
   • DAssign each segment to a separate zone and create policies to allow user-to-server traffic while denying guest-to-server and guest-to-user traffic.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company runs a private cloud on OpenStack and wants to deploy a VM-Series firewall to protect its virtual workloads. The firewall must be highly available to ensure continuous operation. Which HA configuration is supported for VM-Series in this environment?

   • AActive/passive HA with session synchronization
   • BHA using a load balancer to distribute traffic
   • CActive/active HA with session synchronization
   • DHA is not supported for VM-Series in OpenStack
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does segmentation improve network security?

   • ABy reducing the number of IP addresses needed
   • BBy eliminating the need for firewalls
   • CBy increasing the speed of the network
   • DBy limiting the scope of a security breach to a single segment
   Reveal Solution Discussion Select an answer first