AZ-700 Network Security and Compliance 2

Question 1

You need to restrict outbound internet traffic from Azure VMs to only approved FQDNs. Which Azure Firewall feature should you use?

Accepted Answer

Application rules with FQDN tags

Answer

Azure Firewall application rules use FQDN-based filtering to control outbound HTTP/HTTPS traffic to specific domain names.

Question 2

An NSG is applied to both a subnet and a NIC. Traffic arrives at the subnet. In what order are the NSG rules evaluated for inbound traffic?

Accepted Answer

Subnet NSG first, then NIC NSG

Answer

For inbound traffic, the subnet NSG is evaluated first, and if traffic passes, the NIC NSG is evaluated second.

Question 3

Which Azure service provides a managed WAF that protects web applications from OWASP Top 10 vulnerabilities at the edge?

Accepted Answer

Azure Front Door with WAF policy

Answer

Azure Front Door integrates WAF policies that include OWASP Core Rule Sets for protection against common web exploits at the edge.

Question 4

You want to enable threat intelligence-based filtering in Azure Firewall to block known malicious IPs. What must you configure?

Accepted Answer

Set Threat Intel mode to Alert and Deny in Firewall Policy

Answer

Azure Firewall Threat Intelligence mode must be set to 'Alert and Deny' in the Firewall Policy to block traffic from/to known malicious IPs.

Question 5

A company needs to prevent data exfiltration from Azure PaaS services by ensuring traffic stays on the Microsoft backbone. Which feature should be implemented?

Accepted Answer

Service Endpoints with Service Endpoint Policies

Answer

Service Endpoint Policies allow you to filter traffic to specific Azure resources, preventing data exfiltration to unauthorized storage accounts or services.

(AZ-700) Azure Network Engineer Associate Practice Test

(AZ-700) Azure Network Engineer Associate Practice Test

AZ-700 Network Security and Compliance 2