Discuss Palo Alto Networks PSE-StrataDC Exam Topic 3 Question 101

A customer in a non-NSX VMware environment wants to add a VM-Series firewall and to partition an existing group of VMs in the same subnet into two groups. One group needs no additional security, but the second group requires substantially more security.

How can this partition be accomplished without editing the IP addresses or the default gateways of any of the guest VMs?

ACreate a new virtual switch and use the VM-Series firewall to separate virtual switches using Virtual Wire mode Then move the guests that require more security into the new virtual switch

BEdit the IP address of all of the affected VMs

CSend the VLAN out of the virtual environment into a hardware Palo Alto Networks firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete the old default gateway

DCreate a Layer 3 interface in the same subnet as the VMs and configure proxy ARP

Suggested Answer: D

Get Premium PSE-StrataDC Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

21 comments · newest first

Alyce 4 days ago

D could work, but proxy ARP is tricky.

Rana 10 days ago

C seems risky, moving VLANs out.

Amber 15 days ago

Option B is a no-go. Too much hassle.

Devorah 20 days ago

I agree, A is clean and efficient.

Annmarie 25 days ago

It keeps the IPs the same.

Sherell 1 month ago

Why A?

Annmarie 1 month ago

I think option A is the best.

Julianna 1 month ago

Totally agree with A, it keeps everything tidy.

Rodrigo 2 months ago

No way I'm editing IPs, that’s a nightmare!

Mable 2 months ago

Wait, how does proxy ARP even help here?

Tina 2 months ago

I think D could work too, but not as cleanly.

Tom 2 months ago

Option A is the best choice for this scenario.

Mollie 2 months ago

Definitely not B, that would just create more problems!

Alease 2 months ago

Layer 3 interface with proxy ARP (Option D) could work, but seems complicated.

Alverta 3 months ago

Surprised that VLANs can be sent out to a hardware firewall like in Option C!

Nikita 3 months ago

I disagree, editing IPs (Option B) is too disruptive for existing VMs.

Annelle 3 months ago

Option A sounds right, using Virtual Wire mode is a good way to separate traffic.

Kattie 3 months ago

I think using a hardware firewall like in option C could complicate things. It seems like it would require more changes than just separating the VMs.

Sharee 3 months ago

I’m a bit confused about the Layer 3 interface option. Does that really allow for partitioning without changing IPs?

Merilyn 3 months ago

I remember practicing a question similar to this, and I feel like editing the IP addresses would definitely not be the right choice.

Serina 4 months ago

I think option A sounds familiar, but I'm not entirely sure how Virtual Wire mode works with virtual switches.

Palo Alto Networks PSE-StrataDC Exam - Topic 3 Question 101 Discussion