3.3 Manage Third-Party Services to Deploy NGFWs (e.g., Kubernetes, Hypervisors, CSPs, Terraform, Ansible) NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is deploying VM-Series firewalls in Azure and needs to integrate them with Azure Monitor for logging and alerting. They also need to ensure that the firewalls are deployed in a way that meets their security requirements, which include using managed identities for authentication. What is the most effective way to achieve this?

   • ADeploy the firewalls using the Azure portal and configure them to send logs to Azure Monitor using a storage account key.
   • BDeploy the VM-Series firewalls using Terraform, assign a managed identity to each VM, and configure the firewalls to send logs to Azure Monitor using the managed identity for authentication.
   • CDeploy the firewalls using Ansible, and use a service principal for authentication to Azure Monitor.
   • DDeploy the firewalls using Terraform, but configure them to send logs to a third-party SIEM instead of Azure Monitor.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An organization runs VM-Series firewalls on VMware ESXi and wants to use Terraform to manage the deployment. They have a requirement that the firewalls must be deployed in a specific order to ensure that the network is not disrupted. They also need to be able to update the firewall configuration without redeploying the VMs. What is the best way to achieve this?

   • AUse the vSphere Web Client to deploy the VMs in the correct order, and use Terraform only for configuration.
   • BUse Terraform with the vSphere provider to deploy the VMs, and use a bootstrap configuration for the initial setup. Use Terraform's 'depends_on' to control the order of deployment.
   • CUse Terraform to deploy the VMs, and use a separate Ansible playbook to configure them, but do not control the order of deployment.
   • DUse Terraform to deploy the VMs, but manually configure the firewalls after deployment.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   Which Terraform command is used to apply the changes defined in the configuration files to the target environment?

   • Aterraform apply
   • Bterraform plan
   • Cterraform destroy
   • Dterraform init
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization uses Ansible to manage its fleet of VM-Series firewalls. They need to push a new security policy update to all firewalls in a specific device group, but only during a maintenance window. The team wants to ensure the playbook runs only against the intended firewalls and can be re-run safely if a failure occurs. What is the best way to achieve this?

   • AUse the PAN-OS CLI directly on each firewall to apply the policy, and document the steps for the maintenance window.
   • BRun the playbook against all firewalls in the inventory, but use a conditional to skip those not in the device group.
   • CUse an Ansible inventory file that lists the firewalls in the device group, and write a playbook that targets that group and uses the PAN-OS modules to push the policy.
   • DCreate a new playbook for each firewall with hardcoded IP addresses and run them sequentially.
   Reveal Solution Discussion Select an answer first
6. 15foundation · medium

   Which cloud service provider offers a marketplace where NGFW vendors publish their firewall images for direct deployment into a customer's VPC?

   • AVMware vSphere Client
   • BAzure Active Directory
   • CAWS Marketplace
   • DGoogle Cloud Storage
   Reveal Solution Discussion Select an answer first