Refer to the exhibit. Review the screenshots and consider the following information: - FW-1 is assigned to the FW-1_DG device group, and FW-2 is assigned to OFFICE_FW_DG. - There are no objects…

Question

Exhibits

Options

• AServer-1 on FW-1 will have IP 1.1.1.1. Server-1 will not be pushed to FW-2.
• BServer-1 on FW-1 will have IP 3.3.3.3. Server-1 will not be pushed to FW-2.
• CServer-1 on FW-1 will have IP 2.2.2.2. Server-1 will not be pushed to FW-2.
• DServer-1 on FW-1 will have IP 4.4.4.4. Server-1 on FW-2 will have IP 1.1.1.1.

• A
  5% (2)
• B
  8% (3)
• C
  15% (6)
• D
  73% (29)

Explanation

Option D is correct because Panorama pushes address objects using a "most specific wins" inheritance model - FW-1 belongs to FW-1_DG, which has its own definition of Server-1 (IP 4.4.4.4), so that override takes precedence over any parent-level definition. FW-2 belongs to OFFICE_FW_DG, which has no objects configured, and neither does its parent REGIONAL_DG, so FW-2 inherits Server-1 from the Shared level (IP 1.1.1.1) - it still receives the object, just from the top of the hierarchy.

Why the distractors fail:

• A and C incorrectly claim FW-2 won't receive Server-1 at all - Shared-level objects are pushed to all firewalls unless explicitly overridden or the object doesn't exist at any ancestor level.
• B gives FW-1 the wrong IP (3.3.3.3 likely belongs to an intermediate device group like REGIONAL_DG), ignoring that FW-1_DG's own definition (4.4.4.4) is more specific and wins.
• C similarly gives FW-1 an intermediate IP (2.2.2.2), missing that the child device group's definition overrides grandparent/parent values.

Memory tip: Think of Panorama's device group hierarchy like CSS specificity - the most deeply nested (most specific) definition always wins, and if a branch has no definition, the object "falls through" to whatever the nearest ancestor provides, all the way up to Shared.

No community discussion yet for this question.