Palo Alto Networks recommends which two options for outbound HA design in Amazon Web Services using VM-Series NGFW? (Choose two.)

Question

Options

• AiLB-as-next-hop
• Btransit gateway and security VPC with VM-Series
• Ctraditional active/standby HA on VM-Series
• Dtransit VPC and security VPC with VM-Series

• A
  22% (6)
• B
  70% (19)
• D
  7% (2)

Explanation

Palo Alto Networks recommends transit gateway with a security VPC (B) as the modern, cloud-native approach for centralizing outbound traffic inspection at scale - the TGW routes traffic from spoke VPCs through a hub security VPC running VM-Series. Traditional active/standby HA (C) is also recommended as the proven stateful failover mechanism, where a pair of VM-Series instances uses HA links and AWS API-based IP reassignment during failover events.

Option A (iLB-as-next-hop) is incorrect because using an Internal Load Balancer as a route table next-hop is an Azure pattern, not a supported AWS routing mechanism - AWS route tables cannot point to standard load balancers as next hops (only Gateway Load Balancer endpoints in newer designs).

Option D (Transit VPC) is the legacy predecessor to Transit Gateway - it was an older hub-and-spoke workaround before TGW existed and is no longer Palo Alto's recommended design due to complexity and scalability limitations.

Memory tip: Think "Transit Gateway = Today's Good choice" (B is the modern replacement for the older Transit VPC in D), and remember that iLB-as-next-hop belongs to Azure, not AWS.

No community discussion yet for this question.