AZ-700 Network Security and Compliance 4

Question 1

Which feature of Azure Firewall Premium allows inspection of encrypted HTTPS traffic for threats?

Accepted Answer

TLS Inspection with a CA certificate

Answer

IDPS signatures

Answer

Application rule FQDN wildcards

Answer

Threat Intelligence filtering

Question 2

You need to enforce that all new VNets in a subscription must have DDoS Network Protection enabled. Which Azure tool should you use?

Accepted Answer

Azure Policy with a Deny effect

Answer

Azure Blueprints only

Answer

Azure Resource Locks

Answer

Azure Advisor recommendation

Question 3

A multi-tenant SaaS provider needs to offer customers private connectivity to their service without VNet peering. Which Azure feature enables this?

Accepted Answer

Azure Private Link Service

Answer

VNet Gateway with BGP

Answer

Service Endpoints

Answer

ExpressRoute with Microsoft peering

Question 4

Which log type in Microsoft Sentinel helps detect lateral movement by analyzing network connection patterns between Azure resources?

Accepted Answer

NSG Flow Logs ingested via Traffic Analytics

Answer

Azure Activity Logs

Answer

Azure AD Sign-in Logs

Answer

Azure Resource Health events

Question 5

You need to control outbound internet traffic from an Azure Kubernetes Service (AKS) cluster using Azure Firewall. What must you configure in the AKS network settings?

Accepted Answer

Set outboundType to userDefinedRouting and add UDRs to the firewall

Answer

Enable the AKS HTTP application routing add-on

Answer

Configure a NAT gateway on the AKS subnet

Answer

Deploy Azure API Management in front of AKS

Question 6

An NSG rule has priority 100 with Allow on port 443 and priority 200 with Deny on port 443 from the same source. What is the result?

Accepted Answer

Traffic is allowed because lower priority number wins

Answer

Traffic is denied because Deny overrides Allow

Answer

Traffic is blocked because conflicting rules cancel out

Answer

The rule with priority 200 is applied first

Question 7

What is the purpose of the AzurePlatformDNS service tag in NSG rules?

Accepted Answer

Represents Azure's internal DNS infrastructure IP ranges for NSG rules

Answer

Allows DNS queries from Azure DNS to on-premises

Answer

Enables Private DNS zone resolution across VNets

Answer

Routes DNS traffic through Azure Firewall