The customer is seeking centralized policy management to reduce human error while maintaining

compliance with their contractual obligations to AWS and Azure. Here's the evaluation of each

option:

Option A: Cloud NGFWs at both CSPs; provide the customer a license for a Panorama virtual

appliance from their CSP's marketplace of choice to centrally manage the systems

Cloud NGFW is a fully managed Next-Generation Firewall service by Palo Alto Networks, offered in

AWS and Azure marketplaces. It integrates natively with the CSP infrastructure, making it a good fit

for customers with existing CSP agreements.

Panorama, Palo Alto Networks' centralized management solution, can be deployed as a virtual

appliance in the CSP marketplace of choice, enabling centralized policy management across all

NGFWs.

This option addresses the customer's need for centralized management while leveraging their

existing contracts with AWS and Azure.

This option is appropriate.

Option B: Cloud NGFWs in AWS and VM-Series firewall in Azure; the customer selects a PAYG

licensing Panorama deployment in their CSP of choice

This option suggests using Cloud NGFW in AWS but VM-Series firewalls in Azure. While VM-Series is

a flexible virtual firewall solution, it may not align with the customer’s stated preference for CSP-

managed services like Cloud NGFW.

This option introduces a mix of solutions that could complicate centralized management and reduce

operational efficiency.

This option is less appropriate.

Option C: VM-Series firewalls in both CSPs; manually built Panorama in the CSP of choice on a host of

either type: Palo Alto Networks provides a license

VM-Series firewalls are well-suited for cloud deployments but require more manual configuration

compared to Cloud NGFW.

Building a Panorama instance manually on a host increases operational overhead and does not

leverage the customer’s existing CSP marketplaces.

This option is less aligned with the customer's needs.

Option D: VM-Series firewall and CN-Series firewall in both CSPs; provide the customer a private-

offer Panorama virtual appliance from their CSP’s marketplace of choice to centrally manage the

systems

This option introduces both VM-Series and CN-Series firewalls in both CSPs. While CN-Series firewalls

are designed for Kubernetes environments, they may not be relevant if the customer does not

specifically require container-level security.

Adding CN-Series firewalls may introduce unnecessary complexity and costs.

This option is not appropriate.

Reference:

Palo Alto Networks documentation on Cloud NGFW

Panorama overview in Palo Alto Knowledge Base

VM-Series firewalls deployment guide in CSPs: Palo Alto Documentation