AZ-700 Network Security and Compliance 2

Question 1

You need to restrict outbound internet traffic from Azure VMs to only approved FQDNs. Which Azure Firewall feature should you use?

Accepted Answer

Application rules with FQDN tags

Answer

Network rules with IP addresses

Answer

DNAT rules with port mapping

Answer

NAT gateway with prefix filtering

Question 2

An NSG is applied to both a subnet and a NIC. Traffic arrives at the subnet. In what order are the NSG rules evaluated for inbound traffic?

Accepted Answer

Subnet NSG first, then NIC NSG

Answer

NIC NSG first, then subnet NSG

Answer

Both NSGs evaluated simultaneously with most permissive winning

Answer

Only the subnet NSG is evaluated

Question 3

Which Azure service provides a managed WAF that protects web applications from OWASP Top 10 vulnerabilities at the edge?

Accepted Answer

Azure Front Door with WAF policy

Answer

Azure Firewall Premium

Answer

Azure DDoS Protection Standard

Answer

Network Security Groups

Question 4

You want to enable threat intelligence-based filtering in Azure Firewall to block known malicious IPs. What must you configure?

Accepted Answer

Set Threat Intel mode to Alert and Deny in Firewall Policy

Answer

Enable Azure Defender for Network

Answer

Configure a custom IP prefix deny list

Answer

Enable DDoS Protection Standard on the VNet

Question 5

A company needs to prevent data exfiltration from Azure PaaS services by ensuring traffic stays on the Microsoft backbone. Which feature should be implemented?

Accepted Answer

Service Endpoints with Service Endpoint Policies

Answer

VNet Peering

Answer

Public IP with NSG

Answer

Azure Bastion

Question 6

Which Azure Firewall SKU supports IDPS (Intrusion Detection and Prevention System) and TLS inspection?

Accepted Answer

Azure Firewall Premium

Answer

Azure Firewall Basic

Answer

Azure Firewall Standard

Answer

Azure Firewall Developer

Question 7

You need to audit all NSG flow logs for compliance. Which service stores NSG flow logs and enables traffic analytics?

Accepted Answer

Azure Network Watcher with storage account

Answer

Azure Monitor Metrics

Answer

Azure Sentinel only

Answer

Azure Service Bus