AZ-800 Azure Firewall Policies 3

Question 1

A security team wants Azure Firewall to resolve FQDNs in network rules. What must be configured in the firewall policy to enable this?

Accepted Answer

Configure DNS Proxy settings with a custom DNS server

Answer

To use FQDNs in network rules, DNS Proxy must be enabled in the firewall policy so Azure Firewall can resolve names and apply rules based on the resulting IP addresses.

Question 2

What is the maximum priority number that can be assigned to a rule collection group in an Azure Firewall Policy?

Accepted Answer

65000

Answer

Rule collection group priorities in Azure Firewall Policy range from 100 to 65,000, with lower numbers evaluated first.

Question 3

An Azure Firewall Policy is associated with two hub virtual networks in different regions using Azure Firewall Manager. What is a key limitation of this configuration?

Accepted Answer

A single policy can only be associated with one hub virtual network at a time

Answer

Each Azure Firewall instance (hub VNet or Virtual WAN hub) requires its own policy association; a single policy object can be associated with multiple firewalls but each firewall has one active policy.

Question 4

Which Azure Firewall Premium IDPS mode blocks detected intrusion traffic without logging alerts?

Accepted Answer

There is no such mode — Deny always logs alerts

Answer

In Azure Firewall Premium, the IDPS 'Deny' mode both blocks and logs all detected intrusion traffic; there is no block-only-without-log option.

Question 5

A network rule collection in an Azure Firewall Policy has action set to 'Allow'. A subsequent network rule collection in the same policy with lower priority has action 'Deny' for the same traffic. Which action applies?

Accepted Answer

Allow, because rule collections are evaluated in priority order and the first match wins

Answer

Azure Firewall evaluates rule collections in priority order (lowest number first) and stops at the first matching rule, so the Allow collection with higher priority wins.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Azure Firewall Policies 3