In the following scenario, Route-based firewall redundancy is deployed in a Data Center, which statement is true?

Question

Options

• AIP addresses of Firewall interfaces will move between devices when a firewall fails
• BThe 2 firewalls are in Active-Standby HA status
• CFirewalls use dynamic routing protocols to determine the best path
• DFloating IP addresses are necessary for HA configuration

• A
  4% (2)
• B
  6% (3)
• C
  72% (39)
• D
  19% (10)

Explanation

Route-based firewall redundancy relies on dynamic routing protocols (such as OSPF, BGP, or EIGRP) to detect failures and determine which path traffic should take. When one firewall goes down, the routing protocol converges and redirects traffic through the surviving firewall automatically - the routing layer handles redundancy, not a traditional HA mechanism.

Why the distractors are wrong:

• A - Moving IP addresses between devices describes Active-Standby HA with virtual/floating IPs (e.g., VRRP). In route-based redundancy, each firewall retains its own fixed IP addresses permanently.
• B - Route-based redundancy does not require Active-Standby HA. Both firewalls can be Active-Active, each independently forwarding traffic as determined by routing.
• D - Floating IPs are a feature of policy-based or traditional Active-Standby HA. Route-based designs don't need them because the routing protocol, not a shared virtual IP, manages failover.

Memory tip: Associate the word "route" directly with "routing protocols." Route-based = routing protocols do the redundancy work. If you see floating IPs or IP address migration, that's the other kind - policy-based HA.

No community discussion yet for this question.