PCSFE Practice Questions

:

The two deployment modes of VM-Series firewalls that are supported across NSX-T are:

Bootstrap

Service Cluster

NSX-T is a software-defined network (SDN) solution that provides network virtualization,

automation, and security for cloud-native applications. Bootstrap is a method of deploying and

configuring VM-Series firewalls in NSX-T using a bootstrap package that contains the initial setup

information, such as licenses, certificates, software updates, and configuration files. Service Cluster is

a mode of deploying VM-Series firewalls in NSX-T as a group of firewalls that act as a single logical

firewall to provide scalability and high availability. Prism Central, Host-based, and Service Insertion

are not deployment modes of VM-Series firewalls in NSX-T, but they are related concepts that can be

used for other purposes. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE),

[Deploy the VM-Series Firewall on NSX-T], [Bootstrap the VM-Series Firewall for NSX-T], [Deploy the

VM-Series Firewall as a Service Cluster on NSX-T]

Secure Sockets Layer (SSL) Inbound Inspection is the offering that can gain visibility and prevent an

attack by a malicious actor attempting to exploit a known web server vulnerability using encrypted

communication. SSL Inbound Inspection is a feature that allows the firewall to decrypt and inspect

inbound SSL/TLS traffic from external clients to internal servers. SSL Inbound Inspection can gain

visibility and prevent an attack by a malicious actor attempting to exploit a known web server

vulnerability using encrypted communication by applying threat prevention technologies, such as

antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, data filtering, and

WildFire analysis, to the decrypted traffic and blocking any malicious content or activity. OCSP,

Advanced URL Filtering (AURLF), and WildFire are not offerings that can gain visibility and prevent an

attack by a malicious actor attempting to exploit a known web server vulnerability using encrypted

communication, but they are related solutions that can enhance security and visibility.

Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE), [SSL Inbound

Inspection], [Threat Prevention Datasheet]

Access to the Cloud NGFW for AWS console must be enabled when using Terraform templates with a

Cloud next-generation firewall (NGFW) for Amazon Web Services (AWS). Terraform is an open-source

tool that allows users to define and provision infrastructure as code using declarative configuration

files. Terraform templates are files that specify the resources and configuration for deploying and

managing infrastructure components, such as firewalls, load balancers, networks, or servers. Cloud

NGFW for AWS is a cloud-native solution that provides comprehensive security and visibility across

AWS environments, including VPCs, regions, accounts, and workloads. Cloud NGFW for AWS is

deployed and managed by Palo Alto Networks as a service, eliminating the need for customers to

provision, configure, or maintain any infrastructure or software. Access to the Cloud NGFW for AWS

console must be enabled when using Terraform templates with a Cloud NGFW for AWS, as the

console is the web-based interface that allows customers to view and manage their Cloud NGFW for

AWS instances, policies, logs, alerts, and reports. The console also provides the necessary

information and credentials for integrating with Terraform, such as the API endpoint, access key ID,

secret access key, and customer ID. AWS CloudWatch logging, access to the Palo Alto Networks

Customer Support Portal, and AWS Firewall Manager console access do not need to be enabled when

using Terraform templates with a Cloud NGFW for AWS, as those are not required or relevant

components for Terraform integration. Reference: [Palo Alto Networks Certified Software Firewall

Engineer (PCSFE)], [Terraform Overview], [Cloud Next-Generation Firewall Datasheet], [Cloud Next-

Generation Firewall Deployment Guide], [Cloud Next-Generation Firewall Console Guide]

To integrate a Palo Alto Networks VM-Series firewall with Azure Orchestration, you need an API Key.

The API Key is used to authenticate and authorize requests from Azure Orchestration to the VM-

Series firewall. The API Key is generated on the VM-Series firewall and copied to Azure Orchestration.

Reference: [Azure Orchestration Integration with Palo Alto Networks VM-Series Firewalls]

CN-Series high availability (HA) pair is the best solution for securing an EKS environment. EKS is a

managed service that allows users to run Kubernetes clusters on AWS. CN-Series is a containerized

firewall that integrates with Kubernetes and provides visibility and control over container traffic. CN-

Series HA pair consists of two CN-Series firewalls deployed in active-passive mode to provide

redundancy and failover protection. VM-Series single host, PA-Series using load sharing, and API

orchestration are not optimal solutions for securing an EKS environment, as they do not offer the

same level of integration, scalability, and automation as CN-Series. Reference: Palo Alto Networks

Certified Software Firewall Engineer (PCSFE), [CN-Series Deployment Guide for AWS EKS], [CN-Series

Datasheet]

VM-Series firewall is the software firewall that would assist a prospect who is interested in securing

extensive DevOps deployments. DevOps is a set of practices that combines software development

and IT operations to deliver software products faster and more reliably. DevOps deployments require

network security that can protect the traffic between different stages of the software development

lifecycle, such as development, testing, staging, and production, as well as between different cloud

or virtualization platforms, such as public clouds, private clouds, or on-premises data centers. VM-

Series firewall is a virtualized version of the Palo Alto Networks next-generation firewall that can be

deployed on various cloud or virtualization platforms. VM-Series firewall can assist a prospect who is

interested in securing extensive DevOps deployments by providing comprehensive security and

visibility across hybrid and multi-cloud environments, protecting applications and data from

cyberattacks, and supporting automation and orchestration tools that simplify and accelerate the

deployment and configuration of firewalls across different platforms. CN-Series, Ion-Series, and

Cloud next-generation firewall are not software firewalls that would assist a prospect who is

interested in securing extensive DevOps deployments, but they are related solutions that can be

deployed on specific platforms or environments. Reference: Palo Alto Networks Certified Software

Firewall Engineer (PCSFE), [VM-Series Datasheet], [VM-Series Deployment Guide], [What is

DevOps?]

Containers are uniquely suitable for runtime security based on allow lists because containers have

only a few defined processes that should ever be executed. Developers can specify the processes

that are allowed to run in a container using a Dockerfile, but this does not guarantee that only those

processes will run at runtime. Therefore, using an allow list approach can prevent any unauthorized

or malicious processes from running in a container2. Reference: Container Security

CN-Series devices obtain a VM-Series authorization key from Panorama. Panorama is a centralized

management server that provides visibility and control over multiple Palo Alto Networks firewalls

and devices. A VM-Series authorization key is a license key that activates the VM-Series firewall

features and capacities. CN-Series devices obtain a VM-Series authorization key from Panorama by

registering with Panorama using their CPU ID and requesting an authorization code from Panorama’s

license pool. Panorama then generates an authorization key for the CN-Series device and sends it

back to the device for activation. CN-Series devices do not obtain a VM-Series authorization key from

local installation, GitHub, or Customer Support Portal, as those are not valid or relevant sources for

license management. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE),

[Panorama Overview], [VM-Series Licensing Overview], [CN-Series Licensing]

A design consideration for a prospect who wants to deploy VM-Series firewalls in an Amazon Web

Services (AWS) environment is that only active-passive high availability (HA) is supported. High

availability (HA) is a feature that provides redundancy and failover protection for firewalls in case of

hardware or software failure. Active-passive HA is a mode of HA that consists of two firewalls in a

pair, where one firewall is active and handles all traffic, while the other firewall is passive and acts as

a backup. Active-passive HA is the only mode of HA that is supported for VM-Series firewalls in an

AWS environment, due to the limitations of AWS networking and routing. Active-active HA, which is

another mode of HA that consists of two firewalls in a pair that both handle traffic and synchronize

sessions, is not supported for VM-Series firewalls in an AWS environment. A design consideration for

a prospect who wants to deploy VM-Series firewalls in an AWS environment is not that special AWS

plugins are needed for load balancing, resources are shared within the cluster, or high availability

(HA) clusters are limited to fewer than 8 virtual appliances, as those are not valid or relevant factors

for firewall deployment in an AWS environment. Reference: Palo Alto Networks Certified Software

Firewall Engineer (PCSFE), [High Availability Overview], [High Availability on AWS]