AZ-800 Azure Firewall Policies 2 — Questions and Answers
Question 1: A company wants to enforce a baseline firewall policy across all Azure regions while allowing individual teams to add region-specific rules. Which Azure Firewall Policy feature supports this?
- Rule collection groups
- Policy inheritance with parent-child hierarchy (Correct answer)
- IP Groups
- Firewall Manager policy assignments
Correct answer: Policy inheritance with parent-child hierarchy
Azure Firewall Policy supports a parent-child hierarchy where child policies inherit rules from a parent policy, enabling centralized baseline enforcement with regional customization.
Question 2: In an Azure Firewall Policy, what is the evaluation order when both a parent policy and a child policy contain rule collections of the same type?
- Child policy rules are evaluated first, then parent policy rules
- Parent policy rules are evaluated first, then child policy rules (Correct answer)
- Rules are merged and evaluated alphabetically by name
- Only the child policy rules are evaluated; parent rules are ignored
Correct answer: Parent policy rules are evaluated first, then child policy rules
Parent policy rules are always evaluated before child policy rules, ensuring that inherited baseline controls take precedence.
Question 3: Which Azure Firewall Policy feature allows you to define a reusable set of IP addresses that can be referenced across multiple rules without duplication?
- FQDN Tags
- IP Groups (Correct answer)
- Service Tags
- Custom DNS
Correct answer: IP Groups
IP Groups let you group and name a set of IP addresses or ranges that can be referenced in firewall policy rules across multiple rule collections.
Question 4: An administrator needs to allow outbound HTTPS traffic to Windows Update endpoints without manually listing all Microsoft IP ranges. What should they use in an Azure Firewall Policy application rule?
- IP Groups containing Microsoft IP ranges
- A custom FQDN list
- The 'WindowsUpdate' FQDN Tag (Correct answer)
- A network rule with service tag 'AzureCloud'
Correct answer: The 'WindowsUpdate' FQDN Tag
FQDN Tags like 'WindowsUpdate' in application rules automatically represent the FQDNs required for Windows Update traffic, removing the need to maintain IP lists.
Question 5: A firewall policy is configured with Threat Intelligence mode set to 'Alert and Deny'. What happens when traffic matches a known malicious IP?
- Traffic is allowed but an alert is logged
- Traffic is denied and an alert is logged (Correct answer)
- Traffic is quarantined for review
- An administrator must manually approve or deny the traffic
Correct answer: Traffic is denied and an alert is logged
In 'Alert and Deny' mode, Azure Firewall blocks traffic matching threat intelligence indicators and generates an alert in the logs.
Question 6: Which rule collection type in an Azure Firewall Policy is used to filter traffic based on Layer 4 attributes such as source IP, destination IP, port, and protocol?
- Application rule collections
- NAT rule collections
- Network rule collections (Correct answer)
- IDPS rule collections
Correct answer: Network rule collections
Network rule collections in Azure Firewall Policy operate at Layer 4 and filter traffic based on IP addresses, ports, and protocols.
Question 7: An organization uses Azure Firewall Premium and wants to inspect encrypted HTTPS traffic for malware. Which feature must be enabled in the firewall policy?
- Threat Intelligence
- DNS Proxy
- TLS Inspection (Correct answer)
- IDPS in Alert mode
Correct answer: TLS Inspection
TLS Inspection (also called SSL Termination) in Azure Firewall Premium decrypts HTTPS traffic so it can be inspected by application rules, IDPS, and URL filtering.
AZ-800 Azure Firewall Policies 2
A company wants to enforce a baseline firewall policy across all Azure regions while allowing individual teams to add region-specific rules.
Which Azure Firewall Policy feature supports this?