Palo Alto Networks PSE-Strata-Pro-24 Exam - Topic 3 Question 5 Discussion

Actual exam question for Palo Alto Networks's PSE-Strata-Pro-24 exam

Question #: 5
Topic #: 3

A systems engineer (SE) has joined a team to work with a managed security services provider (MSSP) that is evaluating PAN-OS for edge connections to their customer base. The MSSP is concerned about how to efficiently handle routing with all of its customers, especially how to handle BGP peering, because it has created a standard set of rules and settings that it wants to apply to each customer, as well as to maintain and update them. The solution requires logically separated BGP peering setups for each customer. What should the SE do to increase the probability of Palo Alto Networks being awarded the deal?

AWork with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

BCollaborate with the MSSP to create an API call with a standard set of routing filters, maps, and related actions, then the MSSP can call the API whenever they bring on a new customer.

CConfirm to the MSSP that the existing virtual routers will allow them to have logically separated BGP peering setups, but that there is no method to handle the standard criteria across all of the routers.

DEstablish with the MSSP the use of vsys as the better way to segregate their environment so that customer data does not intermingle.

Show Suggested Answer

Suggested Answer: A

To address the MSSP's requirement for logically separated BGP peering setups while efficiently managing standard routing rules and updates, Palo Alto Networks offers the Advanced Routing Engine introduced in PAN-OS 11.0. The Advanced Routing Engine enhances routing capabilities, including support for logical routers, which is critical in this scenario.

Why A is Correct

Logical routers enable the MSSP to create isolated BGP peering configurations for each customer.

The Advanced Routing Engine allows the MSSP to share standard routing profiles (such as filters, policies, or maps) across logical routers, simplifying the deployment and maintenance of routing configurations.

This approach ensures scalability, as each logical router can handle the unique needs of a customer while leveraging shared routing rules.

Why Other Options Are Incorrect

B: While using APIs to automate deployment is beneficial, it does not solve the need for logically separated BGP peering setups. Logical routers provide this separation natively.

C: While virtual routers in PAN-OS can separate BGP peering setups, they do not support the efficient sharing of standard routing rules and profiles across multiple routers.

D: Virtual systems (vsys) are used to segregate administrative domains, not routing configurations. Vsys is not the appropriate solution for managing BGP peering setups across multiple customers.

Key Takeaways:

PAN-OS Advanced Routing Engine with logical routers simplifies BGP peering management for MSSPs.

Logical routers provide the separation required for customer environments while enabling shared configuration profiles.

Palo Alto Networks PAN-OS 11.0 Advanced Routing Documentation

by Arminda at Jan 28, 2025, 06:20 AM

Limited Time Offer

25%

Off

Get Premium PSE-Strata-Pro-24 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leonora

3 months ago

I agree with B, APIs make everything easier for onboarding!

upvoted 0 times

...

Lisbeth

3 months ago

A could really streamline their routing profiles.

upvoted 0 times

...

Mignon

3 months ago

Wait, are we sure C is accurate? That seems limiting.

upvoted 0 times

...

Cristal

4 months ago

I think D is the way to go for better segregation.

upvoted 0 times

...

Jolanda

4 months ago

Option B sounds like a solid plan for scalability.

upvoted 0 times

...

Eden

4 months ago

I feel like option C might be misleading. I thought we learned that virtual routers could indeed support logically separated setups, but I need to double-check that.

upvoted 0 times

...

Kimberlie

4 months ago

I’m a bit uncertain about the implications of using vsys for segregation. I recall it being mentioned in class, but I’m not clear on how it directly relates to BGP peering.

upvoted 0 times

...

Rosina

4 months ago

I think option B sounds familiar. We practiced creating API calls for automation in a similar scenario, which could definitely streamline the onboarding process for new customers.

upvoted 0 times

...

Brynn

5 months ago

I remember discussing the importance of logical routers in PAN-OS, but I'm not entirely sure how they would specifically help with BGP peering setups for each customer.

upvoted 0 times

...

Lisandra

5 months ago

This is a tricky one. The MSSP's requirements around standardization and maintenance seem really important. I'm leaning towards Option B, the API approach, since that could give them a more flexible way to apply those standard settings across their customer base. But I'd want to make sure the API can handle all the necessary routing and BGP functionality.

upvoted 0 times

...

Charolette

5 months ago

Okay, let's think this through. The MSSP wants to maintain and update a standard set of rules for each customer, which sounds like a real challenge. I think Option A, using the Advanced Routing Engine to share routing profiles, could be a good way to address that. But I'm not 100% sure, so I might want to double-check the details on that feature.

upvoted 0 times

...

Jani

5 months ago

Hmm, I'm a bit unsure about this one. The question mentions logical separation for BGP peering, but I'm not sure if the virtual routers in PAN-OS are the right solution. Maybe Option B, using an API, could be a better way to standardize the routing configuration across customers?

upvoted 0 times

...

Zona

5 months ago

This seems like a pretty straightforward question. I'd focus on the key requirements - the MSSP wants to efficiently handle routing and BGP peering, and apply a standard set of rules and settings to each customer. Option A looks like the best approach to address those needs.

upvoted 0 times

...

Delfina

1 year ago

I see your point. Let's focus on planning for logical routers then.

upvoted 0 times

...

Cassi

1 year ago

True, but I think having shared routing profiles is more important.

upvoted 0 times

...

Carlota

1 year ago

But what about option B? Creating an API call could also be efficient.

upvoted 0 times

...

Corazon

1 year ago

I bet the MSSP is hoping Palo Alto Networks can work some 'magic' to solve their routing woes. Time to bust out the BGP wand!

upvoted 0 times

...

Lonny

1 year ago

Using vsys to segregate the environment sounds like a solid approach. Keep the customer data separate, that's key for an MSSP.

upvoted 0 times

Bette

11 months ago

D) Establish with the MSSP the use of vsys as the better way to segregate their environment so that customer data does not intermingle.

upvoted 0 times

...

Shawnda

12 months ago

B) Collaborate with the MSSP to create an API call with a standard set of routing filters, maps, and related actions, then the MSSP can call the API whenever they bring on a new customer.

upvoted 0 times

...

Joesph

12 months ago

A) Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

upvoted 0 times

...

Delfina

1 year ago

I agree, enabling logical routers seems like the best solution.

upvoted 0 times

...

Carmelina

1 year ago

Hmm, the existing virtual routers may not be the best fit if there's no way to apply standard criteria across them. That could be a dealbreaker.

upvoted 0 times

Stevie

11 months ago

D) Establish with the MSSP the use of vsys as the better way to segregate their environment so that customer data does not intermingle.

upvoted 0 times

...

Breana

11 months ago

Hmm, the existing virtual routers may not be the best fit if there's no way to apply standard criteria across them. That could be a dealbreaker.

upvoted 0 times

...

Willow

11 months ago

B) Collaborate with the MSSP to create an API call with a standard set of routing filters, maps, and related actions, then the MSSP can call the API whenever they bring on a new customer.

upvoted 0 times

...

Keva

12 months ago

A) Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

upvoted 0 times

...

Chau

1 year ago

Creating a standardized API call is a smart idea. That way the MSSP can easily onboard new customers without having to manually configure everything.

upvoted 0 times

Beatriz

1 year ago

B) Collaborate with the MSSP to create an API call with a standard set of routing filters, maps, and related actions, then the MSSP can call the API whenever they bring on a new customer.

upvoted 0 times

...

Stefanie

1 year ago

A) Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

upvoted 0 times

...

Ernie

1 year ago

The logical routers in the PAN-OS Advanced Routing Engine seem like the perfect solution to handle the MSSP's routing requirements. I'd suggest working with them to plan for that implementation.

upvoted 0 times

Lera

1 year ago

A) Definitely. It's important to find a solution that meets the MSSP's needs efficiently.

upvoted 0 times

...

Casie

1 year ago

A) Work with the MSSP to plan for the enabling of logical routers in the PAN-OS Advanced Routing Engine to allow sharing of routing profiles across the logical routers.

upvoted 0 times

...

Cecilia

1 year ago

B) That sounds like a good idea. Collaborating with the MSSP to create an API call for standard routing settings could really streamline the process.

upvoted 0 times

...

Cassi

1 year ago

I think we should go with option A.

upvoted 0 times

...