What are two ways to size a VM-Series firewall deployment to secure a VMware ESXi environment? (Choose two )

Question

Options

• Aone per virtual network
• Bone per vCenter server
• Cone per SaaS application in use
• Done per ESXi host

• A
  84% (51)
• B
  5% (3)
• D
  11% (7)

Explanation

Note: The stated correct answer (A, C) appears to be incorrect based on Palo Alto Networks documentation. The actual correct answers are A and D.

Deploying a VM-Series firewall one per virtual network (A) allows segmentation of traffic between different virtual LANs or network zones within the ESXi environment. Deploying one per ESXi host (D) ensures that east-west traffic between VMs running on the same physical host is inspected inline, which is a core use case for VM-Series in virtualized environments.

Why the distractors are wrong:

• B (one per vCenter server) is wrong because vCenter is a management platform, not a traffic boundary - firewall placement is based on where workloads run, not where they're managed.
• C (one per SaaS application) is wrong because SaaS applications live outside the ESXi environment entirely; VM-Series secures traffic within the virtualized infrastructure, not external SaaS boundaries.

Memory tip: Think of VM-Series placement as following the traffic flow. In ESXi, traffic flows within a host (VM-to-VM on the same hypervisor) and across virtual networks - so place firewalls at those boundaries: one per host, one per vnet.

If your study material lists C as correct, double-check the source - this may be a typo or error in the question bank. Palo Alto's official PCNSE materials consistently cite A and D for ESXi sizing.

No community discussion yet for this question.