AZ-800 Azure Firewall Policies 3

Question 1

A security team wants Azure Firewall to resolve FQDNs in network rules. What must be configured in the firewall policy to enable this?

Accepted Answer

Configure DNS Proxy settings with a custom DNS server

Answer

Enable Threat Intelligence

Answer

Set IDPS to 'Alert and Deny'

Answer

Enable TLS Inspection

Question 2

What is the maximum priority number that can be assigned to a rule collection group in an Azure Firewall Policy?

Accepted Answer

65000

Answer

1000

Answer

10000

Answer

100000

Question 3

An Azure Firewall Policy is associated with two hub virtual networks in different regions using Azure Firewall Manager. What is a key limitation of this configuration?

Accepted Answer

A single policy can only be associated with one hub virtual network at a time

Answer

Child policies cannot be used with hub virtual networks

Answer

The policy cannot contain NAT rule collections when used with multiple hubs

Answer

IP Groups cannot be referenced when a policy spans multiple regions

Question 4

Which Azure Firewall Premium IDPS mode blocks detected intrusion traffic without logging alerts?

Accepted Answer

There is no such mode — Deny always logs alerts

Answer

Off

Answer

Alert

Answer

Deny

Question 5

A network rule collection in an Azure Firewall Policy has action set to 'Allow'. A subsequent network rule collection in the same policy with lower priority has action 'Deny' for the same traffic. Which action applies?

Accepted Answer

Allow, because rule collections are evaluated in priority order and the first match wins

Answer

Deny, because deny always overrides allow

Answer

The rules are merged and the most specific match wins

Answer

Both collections are evaluated and an alert is triggered

Question 6

You need to configure Azure Firewall to translate inbound internet traffic on port 443 to an internal web server on port 8443. Which rule type should you configure?

Accepted Answer

DNAT rule in a NAT rule collection

Answer

Network rule with DNAT action

Answer

Application rule with HTTPS protocol

Answer

Network rule with Allow action and port mapping

Question 7

Which Azure Firewall Policy rule collection type is processed BEFORE network rule collections?

Accepted Answer

NAT rule collections

Answer

Application rule collections

Answer

IDPS rule collections

Answer

Threat Intelligence rules