NGFW-ENGINEER · Question #97
An organization must secure its AWS and Azure environments using a managed Palo Alto Networks solution, and all policies must be synchronized from an existing Panorama deployment. The organization…
The correct answer is B. Deploy Cloud NGFW into the vWAN hub as a trusted security partner, and update routing policies D. Deploy Cloud NGFW endpoints into a security virtual private cloud (VPC), and adjust the TGW. In Azure, integrating Cloud NGFW into the Virtual WAN hub as a trusted security partner enables centralized inspection in the hub-and-spoke design while keeping spoke VNets largely unchanged. In AWS, deploying Cloud NGFW endpoints in a dedicated security VPC and steering…
Question
An organization must secure its AWS and Azure environments using a managed Palo Alto Networks solution, and all policies must be synchronized from an existing Panorama deployment. The organization wants to insert security with the least possible impact on its application teams and use existing hub-and-spoke network designs.
- The AWS environment uses a centralized AWS Transit Gateway (TGW)
architecture.
- The Azure environment uses a Virtual WAN (vWAN) hub.
Which two actions are the most appropriate in this use case? (Choose two.)
Options
- ADeploy Cloud NGFW endpoints in every application virtual private cloud (VPC), ignoring the TGW.
- BDeploy Cloud NGFW into the vWAN hub as a trusted security partner, and update routing policies
- CDeploy individual VM-Series firewalls in each spoke virtual network (VNet) and manage them as a
- DDeploy Cloud NGFW endpoints into a security virtual private cloud (VPC), and adjust the TGW
How the community answered
(60 responses)- A7% (4)
- B78% (47)
- C15% (9)
Explanation
In Azure, integrating Cloud NGFW into the Virtual WAN hub as a trusted security partner enables centralized inspection in the hub-and-spoke design while keeping spoke VNets largely unchanged. In AWS, deploying Cloud NGFW endpoints in a dedicated security VPC and steering traffic through them by updating Transit Gateway route tables provides centralized security insertion that can be driven by existing Panorama-managed policy.
Topics
Community Discussion
No community discussion yet for this question.