N10-009 Question 221
Single answerHigh-availability approaches: Active-active, Active-passiveA company is deploying two edge firewalls to improve Internet availability for a customer portal. Management wants both appliances to process production traffic during normal operation so the company can use the full combined throughput. If one firewall fails, sessions should continue through the remaining unit with minimal disruption. Which high-availability approach best meets this requirement?
- A
Active-active clustering, where both firewalls forward traffic simultaneously and share the production load
- B
Active-passive failover, where one firewall handles all traffic until it fails and the standby unit takes over
- C
Cold standby, where the second firewall remains powered off until an administrator manually enables it
- D
Round-robin DNS, where clients alternate between the public IP addresses of two independent firewalls
Show answer and explanation
Correct answer: A
Explanation
The best answer is active-active clustering because the scenario explicitly requires both firewalls to carry production traffic at the same time while still providing failover capability. That is the defining distinction between active-active and active-passive. In active-passive designs, one device is live and the other is on standby, which is useful for redundancy but does not increase normal operating throughput. Network and security vendors commonly describe active-active as appropriate when organizations need load sharing plus availability, while active-passive is typically chosen for simpler failover. Best-practice guidance from firewall and load-balancing documentation also notes that features such as stateful session synchronization are important to minimize disruption during node failure. For Network+, the key practical takeaway is to match the business requirement to the HA model: if both systems must be actively forwarding traffic, choose active-active; if one system should wait as a standby replacement, choose active-passive.
- A. Correct.
Correct. Active-active high availability is designed so multiple devices actively process traffic at the same time. This matches the requirement to use the combined throughput of both firewalls during normal operations while still maintaining redundancy if one unit fails. In real deployments, active-active designs are chosen when organizations want both resiliency and load sharing, assuming the platform supports session synchronization or equivalent state handling.
- B. Incorrect.
Incorrect. Active-passive provides redundancy, but only one firewall actively forwards production traffic during normal operation. The standby unit waits to take over after a failure. This approach does not satisfy the stated requirement that both appliances process live traffic simultaneously to maximize available throughput.
- C. Incorrect.
Incorrect. Cold standby is a manual recovery approach rather than a true high-availability design for minimal disruption. Because the backup firewall is not actively participating and may not even be powered on, failover time is much longer and service interruption is more likely. This would not meet a requirement for continued sessions with minimal disruption.
- D. Incorrect.
Incorrect. Round-robin DNS distributes client connections across multiple IP addresses, but it is not a firewall HA mechanism and does not provide the same coordinated failover behavior as clustered firewalls. DNS caching can delay failover, and independent firewalls without proper HA synchronization may break stateful sessions. This is a common misconception because DNS can balance requests, but it does not replace active-active HA.