3.3 Manage Third-Party Services to Deploy NGFWs (e.g., Kubernetes, Hypervisors, CSPs, Terraform, Ansible) NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses Terraform to manage its Azure infrastructure and wants to deploy VM-Series firewalls in a hub-and-spoke network. They need to ensure that the firewalls are deployed with the correct network interfaces and that the route tables are updated to send traffic through the firewalls. What is the best way to accomplish this?

   • AUse the Azure CLI to create the VMs and then manually update the route tables in the Azure portal.
   • BUse Terraform to deploy the VMs, but configure the route tables using a separate Ansible playbook.
   • CUse Terraform to deploy the VMs and then use the PAN-OS web interface to configure the network interfaces and routing.
   • DUse the AzureRM provider in Terraform to create the VM-Series instances and update the route tables, using a bootstrap configuration to set the initial firewall policy.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A network team manages a fleet of VM-Series firewalls using Ansible. They need to perform a software upgrade on all firewalls, but they want to minimize the risk of downtime. They also need to ensure that the upgrade is rolled back automatically if a firewall fails to come back online after the upgrade. What is the best approach?

   • AUse an Ansible playbook that upgrades the firewalls in batches, checks the health of each firewall after the upgrade, and rolls back to the previous version if the health check fails.
   • BUse a custom script that upgrades all firewalls and relies on the firewall's built-in rollback feature.
   • CUpgrade the firewalls one by one, but do not perform any health checks.
   • DUpgrade all firewalls simultaneously to complete the process quickly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company runs a microservices application on a Kubernetes cluster and wants to deploy a containerized NGFW to inspect east-west traffic between pods. They need the firewall to be managed through the same CI/CD pipeline as the rest of the application. What is the most effective way to integrate the NGFW into this environment?

   • ARun the firewall as a virtual machine on each Kubernetes node and manage it with Ansible.
   • BUse a Kubernetes Service to expose the firewall and configure it via SSH from a jump host.
   • CDeploy the firewall as a standalone pod and manually update its configuration through the management UI.
   • DDeploy the containerized firewall as a DaemonSet and manage its configuration using Kubernetes ConfigMaps and the CI/CD pipeline.
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   What is the primary purpose of using a containerized NGFW in a Kubernetes cluster?

   • ATo store persistent data for applications
   • BTo provide security inspection for traffic between pods and external networks
   • CTo schedule pods onto nodes
   • DTo replace the Kubernetes control plane
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevOps team is deploying a containerized NGFW in a Kubernetes cluster that runs on AWS EKS. They need to ensure that the firewall can inspect traffic between pods and also route traffic to and from the internet. What is the most important consideration for this deployment?

   • ADeploy the firewall as a StatefulSet and configure it to be the default gateway for all pods.
   • BConfigure the firewall as a DaemonSet and use Kubernetes NetworkPolicies to direct traffic through it.
   • CUse the AWS Load Balancer Controller to route all traffic to the firewall pod, regardless of its location.
   • DDeploy the firewall as a single pod and rely on the Kubernetes service mesh to route all traffic through it.
   Reveal Solution Discussion Select an answer first