1.3 Configure High Availability (HA) NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network engineer is configuring a new active/active HA pair. The engineer needs to assign HA interfaces and configure peer identification. What is required for peer identification?

   • AConfigure the HA peer's IP address and the shared HA key.
   • BConfigure the same interface IP addresses on both firewalls.
   • CConfigure the same management IP address on both firewalls.
   • DConfigure the HA pair to use the same virtual router.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company deploys two PA-Series firewalls in an active/active HA pair. Both firewalls are connected to the same Layer 2 segments and share the same virtual router. The network team wants to ensure that traffic from a client to a server is consistently inspected by the same firewall in both directions, even if the return traffic enters the pair through the other firewall. What must be configured to guarantee session consistency?

   • AConfigure the HA pair to use the same session ID on both firewalls by enabling session mirroring.
   • BEnable session ownership on the HA pair and configure flow rules to direct traffic to the firewall that owns the session.
   • CEnable symmetric return on the virtual router to force return traffic to the same firewall.
   • DConfigure the HA pair to use active/passive mode so that only one firewall handles all traffic.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When configuring active/passive HA, what is the purpose of assigning a peer identification (such as a peer ID or HA peer address)?

   • ATo determine which firewall will be active based on the peer ID.
   • BTo assign a unique hostname to each firewall for management purposes.
   • CTo enable the passive firewall to forward traffic if the active firewall is overloaded.
   • DTo allow the firewalls to authenticate each other and establish the HA connection.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary characteristic of an active/passive HA pair in PAN-OS?

   • AOne firewall is active and forwards traffic, while the other is passive and ready to take over on failure.
   • BBoth firewalls actively forward traffic and share the load.
   • CBoth firewalls process traffic but only one is connected to the network.
   • DThe passive firewall periodically takes over to verify its readiness.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does path monitoring determine if a path is available?

   • ABy sending periodic probes (such as ICMP pings) to the configured destination IP address.
   • BBy checking the CPU usage of the firewall.
   • CBy monitoring the routing table for changes.
   • DBy checking the link status of the interface.
   Reveal Solution Discussion Select an answer first