AZ-700 Network Security and Compliance 2 — Questions and Answers
Question 1: You need to restrict outbound internet traffic from Azure VMs to only approved FQDNs. Which Azure Firewall feature should you use?
- Network rules with IP addresses
- Application rules with FQDN tags (Correct answer)
- DNAT rules with port mapping
- NAT gateway with prefix filtering
Correct answer: Application rules with FQDN tags
Azure Firewall application rules use FQDN-based filtering to control outbound HTTP/HTTPS traffic to specific domain names.
Question 2: An NSG is applied to both a subnet and a NIC. Traffic arrives at the subnet. In what order are the NSG rules evaluated for inbound traffic?
- NIC NSG first, then subnet NSG
- Subnet NSG first, then NIC NSG (Correct answer)
- Both NSGs evaluated simultaneously with most permissive winning
- Only the subnet NSG is evaluated
Correct answer: Subnet NSG first, then NIC NSG
For inbound traffic, the subnet NSG is evaluated first, and if traffic passes, the NIC NSG is evaluated second.
Question 3: Which Azure service provides a managed WAF that protects web applications from OWASP Top 10 vulnerabilities at the edge?
- Azure Firewall Premium
- Azure Front Door with WAF policy (Correct answer)
- Azure DDoS Protection Standard
- Network Security Groups
Correct answer: Azure Front Door with WAF policy
Azure Front Door integrates WAF policies that include OWASP Core Rule Sets for protection against common web exploits at the edge.
Question 4: You want to enable threat intelligence-based filtering in Azure Firewall to block known malicious IPs. What must you configure?
- Enable Azure Defender for Network
- Set Threat Intel mode to Alert and Deny in Firewall Policy (Correct answer)
- Configure a custom IP prefix deny list
- Enable DDoS Protection Standard on the VNet
Correct answer: Set Threat Intel mode to Alert and Deny in Firewall Policy
Azure Firewall Threat Intelligence mode must be set to 'Alert and Deny' in the Firewall Policy to block traffic from/to known malicious IPs.
Question 5: A company needs to prevent data exfiltration from Azure PaaS services by ensuring traffic stays on the Microsoft backbone. Which feature should be implemented?
- VNet Peering
- Service Endpoints with Service Endpoint Policies (Correct answer)
- Public IP with NSG
- Azure Bastion
Correct answer: Service Endpoints with Service Endpoint Policies
Service Endpoint Policies allow you to filter traffic to specific Azure resources, preventing data exfiltration to unauthorized storage accounts or services.
Question 6: Which Azure Firewall SKU supports IDPS (Intrusion Detection and Prevention System) and TLS inspection?
- Azure Firewall Basic
- Azure Firewall Standard
- Azure Firewall Premium (Correct answer)
- Azure Firewall Developer
Correct answer: Azure Firewall Premium
Azure Firewall Premium includes IDPS and TLS inspection features not available in the Standard or Basic tiers.
Question 7: You need to audit all NSG flow logs for compliance. Which service stores NSG flow logs and enables traffic analytics?
- Azure Monitor Metrics
- Azure Network Watcher with storage account (Correct answer)
- Azure Sentinel only
- Azure Service Bus
Correct answer: Azure Network Watcher with storage account
NSG flow logs are stored in an Azure Storage account via Network Watcher, and Traffic Analytics can process these logs for visualization and insights.
AZ-700 Network Security and Compliance 2
You need to restrict outbound internet traffic from Azure VMs to only approved FQDNs.
Which Azure Firewall feature should you use?