AZ-700 Network Security and Compliance 4

Question 1

Which feature of Azure Firewall Premium allows inspection of encrypted HTTPS traffic for threats?

Accepted Answer

TLS Inspection with a CA certificate

Answer

TLS Inspection in Azure Firewall Premium decrypts outbound HTTPS traffic using an intermediate CA certificate to inspect content for threats.

Question 2

You need to enforce that all new VNets in a subscription must have DDoS Network Protection enabled. Which Azure tool should you use?

Accepted Answer

Azure Policy with a Deny effect

Answer

An Azure Policy with Deny effect prevents creation of VNets that do not have DDoS Network Protection enabled.

Question 3

A multi-tenant SaaS provider needs to offer customers private connectivity to their service without VNet peering. Which Azure feature enables this?

Accepted Answer

Azure Private Link Service

Answer

Azure Private Link Service lets providers expose their service behind a standard load balancer so customers can connect via Private Endpoints without VNet peering.

Question 4

Which log type in Microsoft Sentinel helps detect lateral movement by analyzing network connection patterns between Azure resources?

Accepted Answer

NSG Flow Logs ingested via Traffic Analytics

Answer

NSG Flow Logs processed through Traffic Analytics reveal communication patterns between resources, helping detect lateral movement in Sentinel.

Question 5

You need to control outbound internet traffic from an Azure Kubernetes Service (AKS) cluster using Azure Firewall. What must you configure in the AKS network settings?

Accepted Answer

Set outboundType to userDefinedRouting and add UDRs to the firewall

Answer

Setting outboundType to 'userDefinedRouting' in AKS tells the cluster to rely on UDRs for egress, allowing you to route traffic through Azure Firewall.

(AZ-700) Azure Network Engineer Associate Practice Test

(AZ-700) Azure Network Engineer Associate Practice Test

AZ-700 Network Security and Compliance 4