PSE-STRATA-PRO-24 practice question 4 of 15

A systems engineer (SE) has joined a team to work with a managed security services provider (MSSP) that is evaluating PAN-OS for edge connections to…

A systems engineer (SE) has joined a team to work with a managed security services provider (MSSP) that is evaluating PAN-OS for edge connections to their customer base. The MSSP is concerned about how to efficiently handle routing with all of its customers, especially how to handle BGP peering, because it has created a standard set of rules and settings that it wants to apply to each customer, as well as to maintain and update them. The solution requires logically separated BGP peering setups for each customer. What should the SE do to increase the probability of Palo Alto Networks being awarded the deal?

Answer options

A: Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers. Correct answer

B: Collaborate with the MSSP to create an API call with a standard set of routing filters, maps, and related actions, then the MSSP can call the API whenever they bring on a new customer.

C: Confirm to the MSSP that the existing virtual routers will allow them to have logically separated BGP peering setups, but that there is no method to handle the standard criteria across all of the routers.

D: Establish with the MSSP the use of vsys as the better way to segregate their environment so that customer data does not intermingle.

Correct Answer:

A. Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

Explanation

The MSSP's requirements for logically separated BGP peering for each customer, combined with the need for a standardized, reusable set of routing rules, are directly addressed by the Advanced Routing Engine feature in PAN-OS. This engine allows the creation of multiple Logical Routers within a single virtual router. Crucially, it also introduces Routing Profile Groups, which act as templates for BGP settings, import/export rules, and redistribution profiles. The SE can demonstrate how the MSSP can create a standard profile and apply it to each new customer's Logical Router, ensuring both separation and operational efficiency.

Why Incorrect

B. Using the API is a method of configuration, but it does not solve the underlying need for a reusable configuration template within PAN-OS for routing policies.
C. Standard virtual routers provide logical separation but lack a mechanism to share or template routing profiles, failing to meet the MSSP's efficiency requirement.
D. While vsys provides multi-tenant separation for policies and management, the routing configuration itself is not templated by vsys and would still require a solution like the Advanced Routing Engine.

References

1. Palo Alto Networks. (n.d.). PAN-OS 11.0 Networking Administrator's Guide: Advanced Routing. Retrieved from https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/networking/advanced-routing. The "Advanced Routing Overview" section introduces Logical Routers for multi-tenancy.

2. Palo Alto Networks. (n.d.). PAN-OS 11.0 Networking Administrator's Guide: Routing Profile Groups. Retrieved from https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/networking/advanced-routing/routing-profile-groups. This section explicitly states, "Routing profile groups allow you to reuse routing configurations across multiple logical routers."

Keep practicing

Take the free PSE-STRATA-PRO-24 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test