Kubernetes/Deployment Type/Environment is the structure of the YAML Ain’t Markup Language

(YAML) file repository. YAML is a human-readable data serialization language that is commonly used

for configuration files. YAML file repository is a collection of YAML files that specify the resources and

configuration for deploying and managing infrastructure components, such as firewalls, load

balancers, networks, or servers. Kubernetes/Deployment Type/Environment is the structure of the

YAML file repository that organizes the YAML files based on the following criteria:

Kubernetes: The

platform

that provides orchestration,

automation,

and management of

containerized applications.

Deployment Type: The method or model of deploying and managing infrastructure components,

such as Terraform, Ansible, Helm, or Kubernetes manifests.

Environment: The type or stage of the cloud or virtualization environment, such as development,

testing,

staging,

or

production.

Deployment

Type/Kubernetes/Environment,

Kubernetes/Environment/Deployment Type, and Environment/Kubernetes/Deployment Type are not

the structure of the YAML file repository, but they are related ways of organizing YAML files based on

different criteria. Reference: [Palo Alto Networks Certified Software Firewall Engineer (PCSFE)],

[What is YAML?], [YAML File Repository]

DNS Security is a service that provides inbound traffic protection by preventing DNS-based attacks.

DNS Security uses machine learning and threat intelligence to identify and block malicious domains,

command and control (C2) traffic, and DNS tunneling. Reference: [DNS Security]

The two factors that lead to improved return on investment for prospects interested in Palo Alto

Networks virtualized next-generation firewalls (NGFWs) are:

Decreased likelihood of data breach

Reduced time to deploy

Palo Alto Networks virtualized NGFWs are virtualized versions of the Palo Alto Networks next-

generation firewall that can be deployed on various cloud or virtualization platforms. Palo Alto

Networks virtualized NGFWs provide comprehensive security and visibility across hybrid and multi-

cloud environments, protecting applications and data from cyberattacks. By using Palo Alto Networks

virtualized NGFWs, prospects can decrease the likelihood of data breach by applying granular

security policies based on application, user, content, and threat information, and by leveraging

cloud-delivered services such as Threat Prevention, WildFire, URL Filtering, DNS Security, and Cortex

Data Lake. By using Palo Alto Networks virtualized NGFWs, prospects can also reduce the time to

deploy by taking advantage of automation and orchestration tools such as Terraform, Ansible,

CloudFormation, ARM templates, and Panorama plugins that simplify and accelerate the deployment

and configuration of firewalls across different cloud platforms. Reduced operational expenditures

and reduced insurance premiums are not factors that lead to improved return on investment for

prospects interested in Palo Alto Networks virtualized NGFWs, but they may be potential benefits or

outcomes of using them. Reference: Palo Alto Networks Certified Software Firewall Engineer (PCSFE),

[VM-Series Datasheet], [CN-Series Datasheet], [Cloud Security Solutions]

Access to the Cloud NGFW for AWS console must be enabled when using Terraform templates with a

Cloud next-generation firewall (NGFW) for Amazon Web Services (AWS). Terraform is an open-source

tool that allows users to define and provision infrastructure as code using declarative configuration

files. Terraform templates are files that specify the resources and configuration for deploying and

managing infrastructure components, such as firewalls, load balancers, networks, or servers. Cloud

NGFW for AWS is a cloud-native solution that provides comprehensive security and visibility across

AWS environments, including VPCs, regions, accounts, and workloads. Cloud NGFW for AWS is

deployed and managed by Palo Alto Networks as a service, eliminating the need for customers to

provision, configure, or maintain any infrastructure or software. Access to the Cloud NGFW for AWS

console must be enabled when using Terraform templates with a Cloud NGFW for AWS, as the

console is the web-based interface that allows customers to view and manage their Cloud NGFW for

AWS instances, policies, logs, alerts, and reports. The console also provides the necessary

information and credentials for integrating with Terraform, such as the API endpoint, access key ID,

secret access key, and customer ID. AWS CloudWatch logging, access to the Palo Alto Networks

Customer Support Portal, and AWS Firewall Manager console access do not need to be enabled when

using Terraform templates with a Cloud NGFW for AWS, as those are not required or relevant

components for Terraform integration. Reference: [Palo Alto Networks Certified Software Firewall

Engineer (PCSFE)], [Terraform Overview], [Cloud Next-Generation Firewall Datasheet], [Cloud Next-

Generation Firewall Deployment Guide], [Cloud Next-Generation Firewall Console Guide]

The two features of CN-Series firewalls that protect east-west traffic between pods in different trust

zones are:

Intrusion prevention system

Layer 7 visibility

East-west traffic is the traffic that flows between applications or workloads within a network or a

cloud environment. Pods are the smallest units of deployment in Kubernetes, consisting of one or

more containers that share resources and network space. Trust zones are segments of the network or

the cloud environment that have different levels of security requirements or policies based on data

sensitivity, user identity, device type, or application function. CN-Series firewalls are containerized

firewalls that integrate with Kubernetes and provide visibility and control over container traffic.

Intrusion prevention system is a feature of CN-Series firewalls that protects east-west traffic between

pods in different trust zones by detecting and blocking known exploits and vulnerabilities using

signature-based and behavior-based methods. Layer 7 visibility is a feature of CN-Series firewalls that

protects east-west traffic between pods in different trust zones by identifying and classifying

applications and protocols based on their content and characteristics, regardless of port, encryption,

or evasion techniques. Communication with Panorama and external load balancer are not features of

CN-Series firewalls that protect east-west traffic between pods in different trust zones, but they are

related features that can enhance management and performance. Reference: Palo Alto Networks

Certified Software Firewall Engineer (PCSFE), [CN-Series Concepts], [CN-Series Deployment Guide for

Native K8], [Intrusion Prevention System Overview], [App-ID Overview]