Palo Alto Networks PSE-SoftwareFirewall Exam - Topic 4 Question 27 Discussion

Actual exam question for Palo Alto Networks's PSE-SoftwareFirewall exam

Question #: 27
Topic #: 4

Why are VM-Series firewalls and hardware firewalls that are external to the Kubernetes cluster problematic for protecting containerized workloads?

AThey function differently based on whether they are located inside or outside of the cluster.

BThey are located outside the cluster and have no visibility into application-level cluster traffic.

CThey are managed by another entity when located inside the cluster.

DThey do not scale independently of the Kubernetes cluster.

Show Suggested Answer

Suggested Answer: B

Visibility into application-level cluster traffic:

VM-Series firewalls and hardware firewalls that are external to the Kubernetes cluster lack the necessary visibility into the traffic and communications occurring at the application level within the cluster. This limitation impedes their ability to effectively protect containerized workloads.

Palo Alto Networks Kubernetes Security Guide

by Kenny at Jul 11, 2025, 02:03 PM

Limited Time Offer

25%

Off

Get Premium PSE-SoftwareFirewall Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Viola

2 months ago

A is true, they really do function differently.

upvoted 0 times

...

Thersa

2 months ago

I disagree, external firewalls can still provide some level of protection.

upvoted 0 times

...

Sanda

3 months ago

Wait, I thought hardware firewalls could be integrated better?

upvoted 0 times

...

Dallas

3 months ago

D seems a bit off, scaling can be managed with the right setup.

upvoted 0 times

...

Floyd

3 months ago

B is spot on! No visibility means less security.

upvoted 0 times

...

Charisse

3 months ago

I practiced a question similar to this, and I think the visibility issue is a key point. So, B seems like the best choice.

upvoted 0 times

...

Janessa

4 months ago

I'm not entirely sure, but I feel like the scaling issue could be a concern too. Maybe it's option D?

upvoted 0 times

...

Lettie

4 months ago

I think option B makes sense because if they're outside, they can't see what's happening inside the cluster, right?

upvoted 0 times

...

Georgene

4 months ago

I remember discussing how external firewalls might miss some of the internal traffic patterns in Kubernetes.

upvoted 0 times

...

Larue

4 months ago

I think the scaling aspect is also important here. If the firewalls don't scale independently of the cluster, that could be a big issue for managing the security of containerized apps. I'll make sure to consider all the options before answering.

upvoted 0 times

...

Gary

4 months ago

The visibility issue is definitely the main problem with having firewalls external to the cluster. They can't see the application-level traffic, so they won't be able to properly protect the containerized workloads. I'm pretty confident that's the right answer.

upvoted 0 times

...

Ruby

5 months ago

Hmm, I'm a bit confused on this one. I know firewalls located outside the cluster won't have visibility into the application-level traffic, but I'm not sure about the other options. I'll need to think this through carefully.

upvoted 0 times

...

Blondell

5 months ago

This question seems straightforward. I think the key is understanding how VM-Series firewalls and hardware firewalls function differently when they're inside or outside the Kubernetes cluster.

upvoted 0 times

...

An

6 months ago

Option B all the way! Kinda like trying to protect a secret club from the outside - you just don't have the inside scoop, you know?

upvoted 0 times

...

Zack

6 months ago

I'm torn between B and D, but I think B is the better choice. Visibility is key, and if the firewall is outside the cluster, it's just not going to cut it.

upvoted 0 times

Colby

5 months ago

I agree, visibility into application-level cluster traffic is crucial.

upvoted 0 times

...

Patria

6 months ago

D seems like the way to go. If the firewall can't scale independently, it won't be able to handle the dynamic nature of containerized environments.

upvoted 0 times

Barbra

5 months ago

D) They do not scale independently of the Kubernetes cluster.

upvoted 0 times

...

Claudio

5 months ago

A) They function differently based on whether they are located inside or outside of the cluster.

upvoted 0 times

...

Sommer

7 months ago

I believe that they do not scale independently of the Kubernetes cluster, which can be a major limitation in dynamic environments.

upvoted 0 times

...

Chana

7 months ago

I'm going with C. If the firewall is managed by another entity inside the cluster, that could create problems for protecting the workloads.

upvoted 0 times

...

Lizette

7 months ago

I agree with you, Lizette. They have no visibility into application-level cluster traffic, which makes them less effective.

upvoted 0 times

...

Herschel

7 months ago

Option B is the correct answer. Firewalls outside the cluster have no visibility into the cluster traffic, making it hard to protect containerized workloads.

upvoted 0 times

Daren

6 months ago

C) They are managed by another entity when located inside the cluster.

upvoted 0 times

...

Arlene

6 months ago

B) They are located outside the cluster and have no visibility into application-level cluster traffic.

upvoted 0 times

...

Shawna

7 months ago

A) They function differently based on whether they are located inside or outside of the cluster.

upvoted 0 times

...

Laticia

7 months ago

I think VM-Series firewalls and external hardware firewalls are problematic for protecting containerized workloads because they are located outside the cluster.

upvoted 0 times

...