A large global company plans to acquire 500 NGFWs to replace its legacy firewalls and...

A large deployment of 500 firewalls requires a scalable, centralized logging and reporting infrastructure. Here's the analysis of each option:

Option A: Combine Panorama for firewall management with Palo Alto Networks' cloud-based Strata Logging Service to offer scalability for the company's logging and reporting infrastructure

TheStrata Logging Service(or Cortex Data Lake) is a cloud-based solution that offers massive scalability for logging and reporting. Combined with Panorama, it allows for centralized log collection, analysis, and policy management without the need for extensive on-premises infrastructure.

This approach is ideal for large-scale environments like the one described in the scenario, as it ensures cost-effectiveness and scalability.

This is the correct recommendation.

Option B: Use Panorama for firewall management and to transfer logs from the 500 firewalls directly to a third-party SIEM for centralized logging and reporting

While third-party SIEM solutions can be integrated with Palo Alto Networks NGFWs, directly transferring logs from 500 firewalls to a SIEM can lead to bottlenecks and scalability issues. Furthermore, relying on third-party solutions may not provide the same level of native integration as the Strata Logging Service.

This is not the ideal recommendation.

Option C: Highlight the efficiency of PAN-OS, which employs AI to automatically extract critical logs and generate daily executive reports, and confirm that the purchase of 500 NGFWs is sufficient

While PAN-OS provides AI-driven insights and reporting, this option does not address the requirement for centralized logging and reporting. It also dismisses the need for additional infrastructure to handle logs from 500 firewalls.

This is incorrect.

Option D: Deploy a pair of M-1000 log collectors in the customer data center, and route logs from all 500 firewalls to the log collectors for centralized logging and reporting

The M-1000 appliance is an on-premises log collector, but it has limitations in terms of scalability and storage capacity when compared to cloud-based options like the Strata Logging Service. Deploying only two M-1000 log collectors for 500 firewalls would result in potential performance and storage challenges.

This is not the best recommendation.

References:

Palo Alto Networks documentation on Panorama

Strata Logging Service (Cortex Data Lake) overview in Palo Alto Networks Docs