Palo Alto Networks (PANW) System Engineer (PSE) Practice Exam

CN-Series as a Kubernetes CNF in HA mode of deployment supports what with session and configuration synchronization?

1. Active/active HA

2. Active/passive HA

3. Passive/passive HA

4. 1:n/n:1

The correct answer is: Active/passive HA

The correct answer reflects how the CN-Series operates in High Availability (HA) mode with session and configuration synchronization. In an active/passive HA configuration, one instance of the CN-Series firewall (the active instance) processes all the traffic and handles the session state, while the second instance (the passive instance) stands by to take over if the active instance fails. This model ensures that both instances are synchronized in terms of configuration and session state, enabling a seamless failover. When the active instance encounters an issue, the passive instance can quickly step in to maintain the continuity of service without losing any active sessions or requiring a manual reconfiguration. The use of active/passive allows organizations to maintain a stable and predictable network environment. In contrast, options such as active/active HA would involve both instances actively processing traffic simultaneously, which is not how the CN-Series operates in the context described. Passive/passive does not allow for active traffic handling at all, and 1:n/n:1 configurations pertain to load balancing rather than HA setups with active failover. Therefore, the active/passive model provides the essential balance of resilience and simplicity for session and configuration management in Kubernetes deployments with the CN-Series.