AZ-800 Azure Firewall Policies 3 — Questions and Answers
Question 1: A security team wants Azure Firewall to resolve FQDNs in network rules. What must be configured in the firewall policy to enable this?
- Enable Threat Intelligence
- Configure DNS Proxy settings with a custom DNS server (Correct answer)
- Set IDPS to 'Alert and Deny'
- Enable TLS Inspection
Correct answer: Configure DNS Proxy settings with a custom DNS server
To use FQDNs in network rules, DNS Proxy must be enabled in the firewall policy so Azure Firewall can resolve names and apply rules based on the resulting IP addresses.
Question 2: What is the maximum priority number that can be assigned to a rule collection group in an Azure Firewall Policy?
- 1000
- 10000
- 65000 (Correct answer)
- 100000
Correct answer: 65000
Rule collection group priorities in Azure Firewall Policy range from 100 to 65,000, with lower numbers evaluated first.
Question 3: An Azure Firewall Policy is associated with two hub virtual networks in different regions using Azure Firewall Manager. What is a key limitation of this configuration?
- A single policy can only be associated with one hub virtual network at a time (Correct answer)
- Child policies cannot be used with hub virtual networks
- The policy cannot contain NAT rule collections when used with multiple hubs
- IP Groups cannot be referenced when a policy spans multiple regions
Correct answer: A single policy can only be associated with one hub virtual network at a time
Each Azure Firewall instance (hub VNet or Virtual WAN hub) requires its own policy association; a single policy object can be associated with multiple firewalls but each firewall has one active policy.
Question 4: Which Azure Firewall Premium IDPS mode blocks detected intrusion traffic without logging alerts?
- Off
- Alert
- Deny
- There is no such mode — Deny always logs alerts (Correct answer)
Correct answer: There is no such mode — Deny always logs alerts
In Azure Firewall Premium, the IDPS 'Deny' mode both blocks and logs all detected intrusion traffic; there is no block-only-without-log option.
Question 5: A network rule collection in an Azure Firewall Policy has action set to 'Allow'. A subsequent network rule collection in the same policy with lower priority has action 'Deny' for the same traffic. Which action applies?
- Deny, because deny always overrides allow
- Allow, because rule collections are evaluated in priority order and the first match wins (Correct answer)
- The rules are merged and the most specific match wins
- Both collections are evaluated and an alert is triggered
Correct answer: Allow, because rule collections are evaluated in priority order and the first match wins
Azure Firewall evaluates rule collections in priority order (lowest number first) and stops at the first matching rule, so the Allow collection with higher priority wins.
Question 6: You need to configure Azure Firewall to translate inbound internet traffic on port 443 to an internal web server on port 8443. Which rule type should you configure?
- Network rule with DNAT action
- Application rule with HTTPS protocol
- DNAT rule in a NAT rule collection (Correct answer)
- Network rule with Allow action and port mapping
Correct answer: DNAT rule in a NAT rule collection
DNAT (Destination Network Address Translation) rules in a NAT rule collection translate inbound traffic from a public IP/port to a private IP/port.
Question 7: Which Azure Firewall Policy rule collection type is processed BEFORE network rule collections?
- Application rule collections
- IDPS rule collections
- NAT rule collections (Correct answer)
- Threat Intelligence rules
Correct answer: NAT rule collections
The evaluation order in Azure Firewall is: NAT rules → Network rules → Application rules, so NAT rule collections are always processed first.
AZ-800 Azure Firewall Policies 3
A security team wants Azure Firewall to resolve FQDNs in network rules.
What must be configured in the firewall policy to enable this?