AZ-700 Network Security and Compliance 3 — Questions and Answers
Question 1: You are configuring Azure Application Gateway WAF in Prevention mode. A legitimate request is being blocked. What is the quickest way to allow it without disabling WAF?
- Switch WAF to Detection mode permanently
- Add a WAF exclusion rule for the specific request attribute (Correct answer)
- Disable the entire rule group
- Create an NSG rule to bypass the Application Gateway
Correct answer: Add a WAF exclusion rule for the specific request attribute
WAF exclusion rules allow you to exclude specific request attributes (headers, cookies, query strings) from WAF evaluation without disabling protection.
Question 2: Which DDoS Protection tier provides adaptive tuning, attack telemetry, and rapid response support for Azure resources?
- DDoS Infrastructure Protection (free)
- DDoS Network Protection (Correct answer)
- DDoS IP Protection
- Azure Firewall Standard
Correct answer: DDoS Network Protection
DDoS Network Protection provides adaptive tuning per-virtual network, detailed attack telemetry, and access to the DDoS Rapid Response team.
Question 3: You need to ensure that a virtual network only communicates with a specific Azure Storage account using a private IP. What should you deploy?
- Service Endpoint
- Private Endpoint (Correct answer)
- VNet Integration
- NAT Gateway
Correct answer: Private Endpoint
A Private Endpoint assigns a private IP from your VNet to the Azure Storage account, allowing private-only access without traversing the public internet.
Question 4: An organization must ensure all inter-VNet traffic is inspected by Azure Firewall. What hub-and-spoke component achieves this?
- VNet Peering with UseRemoteGateways
- User-Defined Routes forcing traffic to the Firewall as next hop (Correct answer)
- Network Security Group on each spoke
- Azure Front Door with routing rules
Correct answer: User-Defined Routes forcing traffic to the Firewall as next hop
User-Defined Routes (UDRs) with the Azure Firewall private IP as the next hop force spoke VNet traffic through the firewall for inspection.
Question 5: Which Azure Policy built-in initiative helps enforce network security compliance for PCI DSS workloads?
- Microsoft cloud security benchmark
- PCI DSS built-in initiative (Correct answer)
- NIST SP 800-53 initiative
- CIS Microsoft Azure Foundations Benchmark
Correct answer: PCI DSS built-in initiative
Azure Policy includes a built-in PCI DSS initiative that maps controls to Azure configurations, helping enforce network and security compliance for cardholder data environments.
Question 6: You need to block SSH and RDP access to Azure VMs from the internet while still allowing access for administrators. What is the recommended solution?
- Open ports 22 and 3389 in NSG for admin IPs only
- Deploy Azure Bastion and block SSH/RDP in NSG
- Use Just-in-Time VM access with Defender for Cloud (Correct answer)
- Use Azure VPN Gateway for all admin access
Correct answer: Use Just-in-Time VM access with Defender for Cloud
Just-in-Time VM access in Microsoft Defender for Cloud temporarily opens SSH/RDP ports only on request, reducing the attack surface.
Question 7: In Azure Firewall Manager, what is a Secured Virtual Hub?
- A VNet with Azure Firewall deployed manually
- An Azure Virtual WAN Hub with Azure Firewall integrated (Correct answer)
- A hub VNet with NSGs applied to all subnets
- A private DNS zone linked to a hub VNet
Correct answer: An Azure Virtual WAN Hub with Azure Firewall integrated
A Secured Virtual Hub is an Azure Virtual WAN hub that has Azure Firewall integrated, managed centrally through Azure Firewall Manager.
AZ-700 Network Security and Compliance 3
You are configuring Azure Application Gateway WAF in Prevention mode.
A legitimate request is being blocked.
What is the quickest way to allow it without disabling WAF?