Examkin

Question

Difficulty: HardResilience, High Availability, and Redundancy

A security engineer is configuring a high-availability perimeter firewall pair using Virtual Router Redundancy Protocol (VRRP) to eliminate single points of failure at the default gateway. During failover testing, when the primary firewall is forcibly rebooted, downstream clients experience dropped sessions and must re-authenticate and re-establish all TCP connections, even though the standby appliance immediately claims the virtual IP address. Which mechanism must be implemented alongside virtual IP redundancy to preserve established network sessions during an unexpected failover?

  1. Stateful connection table synchronization across cluster nodesAnswer
  2. B
    RAID 1 mirrored storage configuration across appliances
  3. C
    Split-scope Dynamic Host Configuration Protocol (DHCP) reservation
  4. D
    Asynchronous off-site continuous configuration snapshot replication

Answer

Stateful connection table synchronization across cluster nodes is required to preserve live connections during failover.
Stateful connection table synchronization continuously mirrors transient firewall session states (such as TCP connection tracking and NAT translation tables) from the active node to the passive node. When the virtual IP shifts via VRRP, the secondary appliance already possesses the full session context, allowing active client connections to continue uninterrupted without requiring re-authentication.

Step-by-Step Solution

1
Analyze the failure symptom in the scenario
Virtual IP failover works correctly (layer 3 IP address transfer), but active TCP sessions are dropped.
VRRP only manages virtual IP address ownership and network routing; it does not replicate layer 4-7 state memory between firewall appliances.
2
Identify the missing high-availability component
Stateful connection table synchronization (e.g., conntrackd or pfsync) is required.
Without state synchronization, the new active firewall views existing client connections as invalid or unrecognized state transitions and drops them.
3
Evaluate candidate options against requirements
Stateful connection table synchronization fulfills the zero-session-drop requirement.
Hardware disk mirroring (RAID 1), DHCP scopes, and configuration backups address local disk storage fault tolerance, IP leasing resilience, and disaster recovery configuration management respectively, not live session persistence.

Key Concept

High-Availability Stateful Session Synchronization vs Virtual IP Failover
Estimated Time:2m 0s
Rate this question

Topics

Resilience, High Availability, and Redundancy

More questions from this topic