As shown in the figure, the firewall is deployed as a gateway dual-machine hot standby, and the upstream and downstream devices are switches. To achieve round-trip traffic load balancing, at least…

Question

Options

• A4
• B6
• C2
• D3

• A
  14% (3)
• B
  5% (1)
• C
  76% (16)
• D
  5% (1)

Explanation

Two VRRP backup groups (C) is correct because the minimum requirement for round-trip load balancing across two firewalls is exactly two groups: one where FW1 is the master (active) and one where FW2 is the master. This splits traffic between the two firewalls while ensuring symmetry - return traffic follows the same path as ingress traffic through the same master firewall, satisfying the "round-trip" constraint.

Why the others are wrong:

• D (3) doesn't map cleanly to a two-firewall topology - an odd number of groups would leave one firewall carrying more load than the other, breaking true load balancing.
• A (4) is the common trap answer: test-takers assume separate VRRP groups are required on both upstream and downstream interfaces (2 + 2 = 4), but the question asks for the minimum needed to achieve the goal, which is 2.
• B (6) overcounts significantly and has no basis in this two-firewall topology.

Memory tip: Think "two firewalls, two groups - one group per firewall as master." VRRP load balancing in dual-hot-standby requires one group per active path, not one group per interface per firewall.

No community discussion yet for this question.