AZ-800 Azure Firewall Policies 2

Question 1

A company wants to enforce a baseline firewall policy across all Azure regions while allowing individual teams to add region-specific rules. Which Azure Firewall Policy feature supports this?

Accepted Answer

Policy inheritance with parent-child hierarchy

Answer

Azure Firewall Policy supports a parent-child hierarchy where child policies inherit rules from a parent policy, enabling centralized baseline enforcement with regional customization.

Question 2

In an Azure Firewall Policy, what is the evaluation order when both a parent policy and a child policy contain rule collections of the same type?

Accepted Answer

Parent policy rules are evaluated first, then child policy rules

Answer

Parent policy rules are always evaluated before child policy rules, ensuring that inherited baseline controls take precedence.

Question 3

Which Azure Firewall Policy feature allows you to define a reusable set of IP addresses that can be referenced across multiple rules without duplication?

Accepted Answer

IP Groups

Answer

IP Groups let you group and name a set of IP addresses or ranges that can be referenced in firewall policy rules across multiple rule collections.

Question 4

An administrator needs to allow outbound HTTPS traffic to Windows Update endpoints without manually listing all Microsoft IP ranges. What should they use in an Azure Firewall Policy application rule?

Accepted Answer

The 'WindowsUpdate' FQDN Tag

Answer

FQDN Tags like 'WindowsUpdate' in application rules automatically represent the FQDNs required for Windows Update traffic, removing the need to maintain IP lists.

Question 5

A firewall policy is configured with Threat Intelligence mode set to 'Alert and Deny'. What happens when traffic matches a known malicious IP?

Accepted Answer

Traffic is denied and an alert is logged

Answer

In 'Alert and Deny' mode, Azure Firewall blocks traffic matching threat intelligence indicators and generates an alert in the logs.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Azure Firewall Policies 2