Exam NGFW-Engineer topic 1 question 32 discussion

Actual exam question from Palo Alto Networks's NGFW-Engineer

Question #: 32
Topic #: 1

An organization runs multiple Kubernetes clusters both on-premises and in public clouds (AWS, Azure, GCP). They want to deploy the Palo Alto Networks CN-Series NGFW to secure east-west traffic within each cluster, maintain consistent Security policies across all environments, and dynamically scale as containerized workloads spin up or down. They also plan to use a centralized Panorama instance for policy management and visibility.
Which approach meets these requirements?

A. Install standalone CN-Series instances in each cluster with local configuration only. Export daily policy configuration snapshots to Panorama for recordkeeping, but do not unify policy enforcement.
B. Configure the CN-Series only in public cloud clusters, and rely on Kubernetes Network Policies for on-premises cluster security. Synchronize partial policy information into Panorama manually as needed.
C. Use Kubernetes-native deployment tools (e.g., Helm) to deploy CN-Series in each cluster, ensuring local insertion into the service mesh or CNI. Manage all CN-Series firewalls centrally from Panorama, applying uniform Security policies across on-premises and cloud clusters.
D. Deploy a single CN-Series firewall in the on-premises data center to process traffic for all clusters, connecting remote clusters via VPN or peering. Manage this single instance through Panorama.

Show Suggested Answer

Suggested Answer: C 🗳️

by Seidor_Analytics at July 29, 2025, 5:50 a.m.

Comments

Submit Cancel

Seidor_Analytics

4 days, 4 hours ago

Selected Answer: B

I'm gonna take a wild guess and say B. This topic is my weak spot.

upvoted 1 times

...