AZ-800 Azure Firewall Policies 4

Question 1

An administrator creates an Azure Firewall Policy with a rule collection group at priority 200 and another at priority 300. Which group's rules are evaluated first?

Accepted Answer

Priority 200, because lower numbers are evaluated first

Answer

Priority 300, because higher numbers have higher priority

Answer

Both groups are evaluated simultaneously

Answer

The group created most recently is evaluated first

Question 2

A company wants centralized management of Azure Firewall Policies across multiple subscriptions. Which Azure service provides this capability?

Accepted Answer

Azure Firewall Manager

Answer

Azure Policy

Answer

Azure Monitor

Answer

Azure Security Center

Question 3

In Azure Firewall Premium, which feature uses a signature-based detection engine to identify and block network-based attacks?

Accepted Answer

Intrusion Detection and Prevention System (IDPS)

Answer

Threat Intelligence

Answer

TLS Inspection

Answer

URL Filtering

Question 4

A firewall policy has an application rule allowing traffic to *.contoso.com. A separate network rule denies all traffic to 40.90.0.0/16, which is an IP used by contoso.com. What happens to HTTPS requests to login.contoso.com?

Accepted Answer

The network rule denies it because network rules are evaluated before application rules

Answer

The application rule allows it because application rules take precedence over network rules

Answer

Both rules match and traffic is allowed because Allow overrides Deny

Answer

Traffic is blocked by Threat Intelligence before either rule is evaluated

Question 5

Which log category in Azure Firewall captures details about traffic matched by application rules, including the target FQDN and action taken?

Accepted Answer

AzureFirewallApplicationRule

Answer

AzureFirewallNetworkRule

Answer

AzureFirewallDnsProxy

Answer

AzureFirewallThreatIntel

Question 6

You are configuring a child firewall policy and notice that a rule from the parent policy conflicts with a rule you want to add to the child. What is the correct behavior?

Accepted Answer

The parent policy rule takes precedence because parent rules are evaluated first

Answer

The child policy rule overrides the parent policy rule

Answer

Conflicting rules cause a policy validation error and the child policy cannot be saved

Answer

Both rules are applied and traffic matching both is allowed

Question 7

Which Azure Firewall Policy setting, when enabled, forces all DNS queries from VMs in connected VNets to route through the firewall for resolution?

Accepted Answer

DNS Proxy

Answer

Threat Intelligence DNS filtering

Answer

Custom DNS server override

Answer

FQDN-based network rules