2.2 Configure Virtual Systems (VSYS) NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 2)

Questions 6–9

1. 6application · medium

   A company is segmenting its network into two virtual systems: VSYS-A for the finance department and VSYS-B for the engineering department. Each VSYS has its own set of subinterfaces and zones. The network administrator needs to ensure that traffic from VSYS-A can reach a server in VSYS-B, but only through a specific gateway. The administrator has created a virtual router for each VSYS. What must be configured to enable this inter-VSYS communication?

   • AAdd a static route in VSYS-A's virtual router pointing to the IP address of VSYS-B's virtual router, and a corresponding route in VSYS-B's virtual router.
   • BAssign the same virtual router to both VSYS-A and VSYS-B, and then configure security policies to allow the traffic.
   • CConfigure a security policy that allows all traffic between the zones of VSYS-A and VSYS-B, and no routing is needed.
   • DCreate a logical router within VSYS-A and configure a static route to VSYS-B's subnet.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When configuring a virtual router for a virtual system (VSYS) on a Palo Alto Networks firewall, what is the correct relationship between the virtual router and the VSYS?

   • AA virtual router can be shared across multiple VSYSs to allow inter-VSYS routing without additional configuration.
   • BVirtual routers are global objects that must be assigned to each VSYS individually.
   • CA virtual router is created within a VSYS and can be assigned to that VSYS or shared with other VSYSs.
   • DEach VSYS must have its own dedicated virtual router; sharing is not supported.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When configuring a virtual system (VSYS) on a Palo Alto Networks firewall, which action is required to make a physical interface available for use by that VSYS?

   • AAssign the interface to the VSYS and then bind it to a zone within that VSYS.
   • BCreate a subinterface for the VSYS and assign it to the default zone automatically.
   • CConfigure the interface as a layer 3 interface and it becomes available to all VSYSs.
   • DPlace the interface in the shared zone so all VSYSs can use it.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A network engineer needs to create a subinterface on a Palo Alto Networks firewall and assign it to a specific virtual system. Which configuration step is mandatory for this subinterface?

   • ASelect the parent interface's VSYS and then create the subinterface with a unique tag.
   • BAdd the subinterface to the shared VSYS to allow all VSYSs to use it.
   • CConfigure the subinterface with an IP address and it will automatically join the VSYS of the parent interface.
   • DAssign the subinterface to a VSYS and then bind it to a zone within that VSYS.
   Reveal Solution Discussion Select an answer first