Examkin

Soru

Zorluk: ZorResilience, High Availability, and Redundancy

A security engineer is configuring a high-availability perimeter firewall pair using Virtual Router Redundancy Protocol (VRRP) to eliminate single points of failure at the default gateway. During failover testing, when the primary firewall is forcibly rebooted, downstream clients experience dropped sessions and must re-authenticate and re-establish all TCP connections, even though the standby appliance immediately claims the virtual IP address. Which mechanism must be implemented alongside virtual IP redundancy to preserve established network sessions during an unexpected failover?

  1. Stateful connection table synchronization across cluster nodesCevap
  2. B
    RAID 1 mirrored storage configuration across appliances
  3. C
    Split-scope Dynamic Host Configuration Protocol (DHCP) reservation
  4. D
    Asynchronous off-site continuous configuration snapshot replication

Cevap

Stateful connection table synchronization across cluster nodes is required to preserve live connections during failover.
Stateful connection table synchronization continuously mirrors transient firewall session states (such as TCP connection tracking and NAT translation tables) from the active node to the passive node. When the virtual IP shifts via VRRP, the secondary appliance already possesses the full session context, allowing active client connections to continue uninterrupted without requiring re-authentication.

Adım Adım Çözüm

1
Analyze the failure symptom in the scenario
Virtual IP failover works correctly (layer 3 IP address transfer), but active TCP sessions are dropped.
VRRP only manages virtual IP address ownership and network routing; it does not replicate layer 4-7 state memory between firewall appliances.
2
Identify the missing high-availability component
Stateful connection table synchronization (e.g., conntrackd or pfsync) is required.
Without state synchronization, the new active firewall views existing client connections as invalid or unrecognized state transitions and drops them.
3
Evaluate candidate options against requirements
Stateful connection table synchronization fulfills the zero-session-drop requirement.
Hardware disk mirroring (RAID 1), DHCP scopes, and configuration backups address local disk storage fault tolerance, IP leasing resilience, and disaster recovery configuration management respectively, not live session persistence.

Anahtar Kavram

High-Availability Stateful Session Synchronization vs Virtual IP Failover
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Resilience, High Availability, and Redundancy

Bu konudan daha fazla soru