AZ-800 Azure Firewall Policies 2

Question 1

A company wants to enforce a baseline firewall policy across all Azure regions while allowing individual teams to add region-specific rules. Which Azure Firewall Policy feature supports this?

Accepted Answer

Policy inheritance with parent-child hierarchy

Answer

Rule collection groups

Answer

IP Groups

Answer

Firewall Manager policy assignments

Question 2

In an Azure Firewall Policy, what is the evaluation order when both a parent policy and a child policy contain rule collections of the same type?

Accepted Answer

Parent policy rules are evaluated first, then child policy rules

Answer

Child policy rules are evaluated first, then parent policy rules

Answer

Rules are merged and evaluated alphabetically by name

Answer

Only the child policy rules are evaluated; parent rules are ignored

Question 3

Which Azure Firewall Policy feature allows you to define a reusable set of IP addresses that can be referenced across multiple rules without duplication?

Accepted Answer

IP Groups

Answer

FQDN Tags

Answer

Service Tags

Answer

Custom DNS

Question 4

An administrator needs to allow outbound HTTPS traffic to Windows Update endpoints without manually listing all Microsoft IP ranges. What should they use in an Azure Firewall Policy application rule?

Accepted Answer

The 'WindowsUpdate' FQDN Tag

Answer

IP Groups containing Microsoft IP ranges

Answer

A custom FQDN list

Answer

A network rule with service tag 'AzureCloud'

Question 5

A firewall policy is configured with Threat Intelligence mode set to 'Alert and Deny'. What happens when traffic matches a known malicious IP?

Accepted Answer

Traffic is denied and an alert is logged

Answer

Traffic is allowed but an alert is logged

Answer

Traffic is quarantined for review

Answer

An administrator must manually approve or deny the traffic

Question 6

Which rule collection type in an Azure Firewall Policy is used to filter traffic based on Layer 4 attributes such as source IP, destination IP, port, and protocol?

Accepted Answer

Network rule collections

Answer

Application rule collections

Answer

NAT rule collections

Answer

IDPS rule collections

Question 7

An organization uses Azure Firewall Premium and wants to inspect encrypted HTTPS traffic for malware. Which feature must be enabled in the firewall policy?

Accepted Answer

TLS Inspection

Answer

Threat Intelligence

Answer

DNS Proxy

Answer

IDPS in Alert mode