AZ-700 Network Security and Compliance 3

Question 1

You are configuring Azure Application Gateway WAF in Prevention mode. A legitimate request is being blocked. What is the quickest way to allow it without disabling WAF?

Accepted Answer

Add a WAF exclusion rule for the specific request attribute

Answer

Switch WAF to Detection mode permanently

Answer

Disable the entire rule group

Answer

Create an NSG rule to bypass the Application Gateway

Question 2

Which DDoS Protection tier provides adaptive tuning, attack telemetry, and rapid response support for Azure resources?

Accepted Answer

DDoS Network Protection

Answer

DDoS Infrastructure Protection (free)

Answer

DDoS IP Protection

Answer

Azure Firewall Standard

Question 3

You need to ensure that a virtual network only communicates with a specific Azure Storage account using a private IP. What should you deploy?

Accepted Answer

Private Endpoint

Answer

Service Endpoint

Answer

VNet Integration

Answer

NAT Gateway

Question 4

An organization must ensure all inter-VNet traffic is inspected by Azure Firewall. What hub-and-spoke component achieves this?

Accepted Answer

User-Defined Routes forcing traffic to the Firewall as next hop

Answer

VNet Peering with UseRemoteGateways

Answer

Network Security Group on each spoke

Answer

Azure Front Door with routing rules

Question 5

Which Azure Policy built-in initiative helps enforce network security compliance for PCI DSS workloads?

Accepted Answer

PCI DSS built-in initiative

Answer

Microsoft cloud security benchmark

Answer

NIST SP 800-53 initiative

Answer

CIS Microsoft Azure Foundations Benchmark

Question 6

You need to block SSH and RDP access to Azure VMs from the internet while still allowing access for administrators. What is the recommended solution?

Accepted Answer

Use Just-in-Time VM access with Defender for Cloud

Answer

Open ports 22 and 3389 in NSG for admin IPs only

Answer

Deploy Azure Bastion and block SSH/RDP in NSG

Answer

Use Azure VPN Gateway for all admin access

Question 7

In Azure Firewall Manager, what is a Secured Virtual Hub?

Accepted Answer

An Azure Virtual WAN Hub with Azure Firewall integrated

Answer

A VNet with Azure Firewall deployed manually

Answer

A hub VNet with NSGs applied to all subnets

Answer

A private DNS zone linked to a hub VNet