Palo Alto Networks NetSec-Pro Exam - Topic 2 Question 9 Discussion

Actual exam question for Palo Alto Networks's NetSec-Pro exam

Question #: 9
Topic #: 2

A network security engineer needs to implement segmentation but is under strict compliance requirements to place security enforcement as close as possible to the private applications hosted in Azure. Which deployment style is valid and meets the requirements in this scenario?

AOn a VM-Series NGFW, configure several Layer 2 zones with Layer 2 interfaces assigned to logically segment the network.

BOn a PA-Series NGFW, configure several Layer 2 zones with Layer 2 interfaces assigned to logically segment the network.

COn a VM-Series NGFW, configure several Layer 3 zones with Layer 3 interfaces assigned to logically segment the network.

DOn a PA-Series NGFW, configure several Layer 3 zones with Layer 3 interfaces assigned to logically segment the network.

Show Suggested Answer

Suggested Answer: C

In cloud environments like Azure, the VM-Series NGFW is deployed to create Layer 3 segmentation zones closest to the application workloads.

''In Azure, deploy VM-Series firewalls in Layer 3 mode to enforce security policies closest to private applications, meeting strict compliance and segmentation requirements.''

(Source: VM-Series in Public Clouds)

Layer 3 segmentation ensures security policies are enforced at the right boundary to isolate traffic within Azure's virtual networks.

by Vallie at Aug 02, 2025, 08:21 PM

Limited Time Offer

25%

Off

Get Premium NetSec-Pro Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Florinda

2 months ago

Wait, can you really use Layer 3 zones for this? Seems off.

upvoted 0 times

...

Alpha

2 months ago

Totally agree, Layer 2 is key for compliance!

upvoted 0 times

...

Belen

3 months ago

Not sure if Layer 2 is enough for strict compliance, though.

upvoted 0 times

...

Elza

3 months ago

B looks solid too, but I lean towards A.

upvoted 0 times

...

Jules

3 months ago

I think option A is the best choice for Layer 2 segmentation.

upvoted 0 times

...

Lorean

3 months ago

I thought PA-Series was more robust for compliance, but I can't quite recall if it was Layer 2 or Layer 3 that we focused on in our last review.

upvoted 0 times

...

Alaine

4 months ago

I feel like the VM-Series NGFW is the right choice here, but I’m a bit confused about whether Layer 2 or Layer 3 is more compliant with security requirements.

upvoted 0 times

...

Rachael

4 months ago

I think we practiced a similar question, and I recall that using Layer 3 might be more common for segmentation, but I can't remember the specifics.

upvoted 0 times

...

Weldon

4 months ago

I remember something about Layer 2 and Layer 3 zones, but I'm not sure which one is better for segmentation in Azure.

upvoted 0 times

...

Aleisha

4 months ago

I've got this! The question is asking for a valid deployment style that meets the compliance requirements, so I'm going to go with option A - configuring Layer 2 zones on a VM-Series NGFW.

upvoted 0 times

...

Reita

4 months ago

Okay, the key here is that the security enforcement needs to be as close as possible to the private applications in Azure. I think that rules out the Layer 3 options and points me towards the Layer 2 solutions.

upvoted 0 times

...

Ronnie

5 months ago

Hmm, I'm a bit confused about the difference between Layer 2 and Layer 3 zones. I'll need to review that concept before deciding on the answer.

upvoted 0 times

...

Jillian

5 months ago

This seems like a straightforward question about network segmentation. I'll need to carefully read through the options and think about which one best meets the requirements.

upvoted 0 times

...

Fidelia

5 months ago

I'm leaning towards C actually.

upvoted 0 times

...

Ammie

6 months ago

I disagree, I believe the correct answer is D.

upvoted 0 times

...

Enola

7 months ago

Option C looks good to me. Segmenting the network using Layer 3 zones on a VM-Series NGFW seems like the way to go to meet the compliance requirements.

upvoted 0 times

Deeanna

5 months ago

I agree, using Layer 3 zones with Layer 3 interfaces would provide the necessary security enforcement close to the private applications.

upvoted 0 times

...

Chauncey

5 months ago

Option C looks good to me. Segmenting the network using Layer 3 zones on a VM-Series NGFW seems like the way to go to meet the compliance requirements.

upvoted 0 times

...

Erick

7 months ago

I think the answer is A.

upvoted 0 times

...