2.1 Explain the Function of Cloud NGFWs, PA-Series, CN-Series, and VM-Series Firewalls (e.g., Perimeter and Core Security, Zone Security and Segmentation, High Availability [HA], Security and NAT Policy Implementation, Monitoring and Logging) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In an HA pair, what is the role of the passive firewall?

   • ATo manage the active firewall's configuration
   • BTo monitor the active firewall and take over if it fails
   • CTo provide additional security policy processing
   • DTo load-balance traffic with the active firewall
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A DevOps team runs a microservices application on Amazon EKS. They need to enforce security policies between pods in different namespaces and inspect traffic between services. The solution must be managed as part of the Kubernetes infrastructure and support Kubernetes-native policy definitions. Which firewall type is most appropriate?

   • AUse a PA-Series firewall in the data center and extend the VPC with a VPN.
   • BDeploy a CN-Series firewall as a DaemonSet in the EKS cluster.
   • CUse AWS Security Groups to restrict traffic between pods.
   • DDeploy a VM-Series firewall in the same VPC and route pod traffic through it.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a best practice for creating security policies?

   • AUse specific rules and place them before broader rules
   • BCreate rules without specifying applications
   • CUse only broad rules to simplify management
   • DPlace all rules in a single policy for simplicity
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a common method for integrating firewall logs with a central management or SIEM system?

   • AUsing HA to replicate logs
   • BUsing NAT to translate logs
   • CUsing security policies to send logs
   • DUsing syslog to forward logs to the SIEM
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization wants to deploy a firewall at the edge of its network to protect against external threats. The firewall must be able to inspect all inbound and outbound traffic, block known malware, and prevent intrusion attempts. Which firewall type and feature set should be used?

   • ACloud NGFW with only URL filtering.
   • BVM-Series firewall with basic security policies.
   • CPA-Series firewall with Threat Prevention and WildFire subscriptions.
   • DCN-Series firewall with Kubernetes Network Policies.
   Reveal Solution Discussion Select an answer first