Which three capabilities and characteristics are shared by the deployments of Cloud NGFW for Azure...

Cloud NGFW for Azure and VM-Series share certain functionalities due to their common PAN-OS foundation.

Why A, C, and D are correct:

A. Panorama management: Both Cloud NGFW for Azure and VM-Series firewalls can be managed by Panorama, providing centralized management and policy enforcement.

C. Transparent inspection of private-to-private east-west traffic that preserves client source IP address: Both platforms support this type of inspection, which is crucial for security and visibility within Azure virtual networks.

D. Inter-VNet inspection through a transit VNet: Both can be deployed in a transit VNet architecture to inspect traffic between different virtual networks.

Why B and E are incorrect:

B. Inter-VNet inspection through Virtual WAN hub: While VM-Series can be integrated with Azure Virtual WAN, Cloud NGFW for Azure is directly integrated and doesn't require a separate transit VNet or hub for basic inter-VNet inspection. It uses Azure's native networking.

E. Use of routing intent policies to apply security policies: Routing intent is specific to Cloud NGFW for Azure's integration with Azure networking and is not a feature of VM-Series. VM-Series uses standard security policies and routing configurations within the VNet.

Palo Alto Networks References:

Cloud NGFW for Azure Documentation: This documentation details the architecture and integration with Azure networking.

VM-Series Deployment Guide for Azure: This guide covers deployment architectures, including transit VNet deployments.

Panorama Administrator's Guide: This guide explains how to manage both platforms using Panorama.