AZ-700 Network Security and Compliance 3

Question 1

You are configuring Azure Application Gateway WAF in Prevention mode. A legitimate request is being blocked. What is the quickest way to allow it without disabling WAF?

Accepted Answer

Add a WAF exclusion rule for the specific request attribute

Answer

WAF exclusion rules allow you to exclude specific request attributes (headers, cookies, query strings) from WAF evaluation without disabling protection.

Question 2

Which DDoS Protection tier provides adaptive tuning, attack telemetry, and rapid response support for Azure resources?

Accepted Answer

DDoS Network Protection

Answer

DDoS Network Protection provides adaptive tuning per-virtual network, detailed attack telemetry, and access to the DDoS Rapid Response team.

Question 3

You need to ensure that a virtual network only communicates with a specific Azure Storage account using a private IP. What should you deploy?

Accepted Answer

Private Endpoint

Answer

A Private Endpoint assigns a private IP from your VNet to the Azure Storage account, allowing private-only access without traversing the public internet.

Question 4

An organization must ensure all inter-VNet traffic is inspected by Azure Firewall. What hub-and-spoke component achieves this?

Accepted Answer

User-Defined Routes forcing traffic to the Firewall as next hop

Answer

User-Defined Routes (UDRs) with the Azure Firewall private IP as the next hop force spoke VNet traffic through the firewall for inspection.

Question 5

Which Azure Policy built-in initiative helps enforce network security compliance for PCI DSS workloads?

Accepted Answer

PCI DSS built-in initiative

Answer

Azure Policy includes a built-in PCI DSS initiative that maps controls to Azure configurations, helping enforce network and security compliance for cardholder data environments.

(AZ-700) Azure Network Engineer Associate Practice Test

(AZ-700) Azure Network Engineer Associate Practice Test

AZ-700 Network Security and Compliance 3