AZ-800 Azure Firewall Policies 4 — Questions and Answers
Question 1: An administrator creates an Azure Firewall Policy with a rule collection group at priority 200 and another at priority 300. Which group's rules are evaluated first?
- Priority 300, because higher numbers have higher priority
- Priority 200, because lower numbers are evaluated first (Correct answer)
- Both groups are evaluated simultaneously
- The group created most recently is evaluated first
Correct answer: Priority 200, because lower numbers are evaluated first
In Azure Firewall Policy, rule collection groups with lower priority numbers are evaluated before those with higher numbers.
Question 2: A company wants centralized management of Azure Firewall Policies across multiple subscriptions. Which Azure service provides this capability?
- Azure Policy
- Azure Firewall Manager (Correct answer)
- Azure Monitor
- Azure Security Center
Correct answer: Azure Firewall Manager
Azure Firewall Manager provides centralized security management for Azure Firewall policies across multiple subscriptions and virtual networks.
Question 3: In Azure Firewall Premium, which feature uses a signature-based detection engine to identify and block network-based attacks?
- Threat Intelligence
- TLS Inspection
- Intrusion Detection and Prevention System (IDPS) (Correct answer)
- URL Filtering
Correct answer: Intrusion Detection and Prevention System (IDPS)
IDPS in Azure Firewall Premium uses a signature-based engine with over 58,000 signatures to detect and optionally block network intrusion attempts.
Question 4: A firewall policy has an application rule allowing traffic to *.contoso.com. A separate network rule denies all traffic to 40.90.0.0/16, which is an IP used by contoso.com. What happens to HTTPS requests to login.contoso.com?
- The application rule allows it because application rules take precedence over network rules
- The network rule denies it because network rules are evaluated before application rules (Correct answer)
- Both rules match and traffic is allowed because Allow overrides Deny
- Traffic is blocked by Threat Intelligence before either rule is evaluated
Correct answer: The network rule denies it because network rules are evaluated before application rules
Network rules are evaluated before application rules in Azure Firewall; if the network deny rule matches first, traffic is blocked regardless of the application rule.
Question 5: Which log category in Azure Firewall captures details about traffic matched by application rules, including the target FQDN and action taken?
- AzureFirewallNetworkRule
- AzureFirewallApplicationRule (Correct answer)
- AzureFirewallDnsProxy
- AzureFirewallThreatIntel
Correct answer: AzureFirewallApplicationRule
The AzureFirewallApplicationRule log category records application rule matches including FQDNs, URLs, protocols, and the action (Allow/Deny) taken.
Question 6: You are configuring a child firewall policy and notice that a rule from the parent policy conflicts with a rule you want to add to the child. What is the correct behavior?
- The child policy rule overrides the parent policy rule
- The parent policy rule takes precedence because parent rules are evaluated first (Correct answer)
- Conflicting rules cause a policy validation error and the child policy cannot be saved
- Both rules are applied and traffic matching both is allowed
Correct answer: The parent policy rule takes precedence because parent rules are evaluated first
In the parent-child policy hierarchy, parent rules are always evaluated first and take precedence; child policies cannot override inherited parent rules.
Question 7: Which Azure Firewall Policy setting, when enabled, forces all DNS queries from VMs in connected VNets to route through the firewall for resolution?
- Threat Intelligence DNS filtering
- DNS Proxy (Correct answer)
- Custom DNS server override
- FQDN-based network rules
Correct answer: DNS Proxy
Enabling DNS Proxy in the firewall policy causes the firewall to act as a DNS forwarder; configuring VNet DNS settings to point to the firewall IP routes all DNS traffic through it.
AZ-800 Azure Firewall Policies 4
An administrator creates an Azure Firewall Policy with a rule collection group at priority 200 and another at priority 300.
Which group's rules are evaluated first?