AZ-800 Azure Firewall Policies 5 — Questions and Answers
Question 1: An Azure Firewall Policy is configured in a Virtual WAN secured hub. What is different about this deployment compared to a standard VNet hub deployment?
- Virtual WAN secured hubs do not support application rule collections
- The policy is managed by Azure Firewall Manager and routes are auto-managed by the hub (Correct answer)
- Child policies cannot be associated with Virtual WAN secured hubs
- TLS Inspection is not supported in Virtual WAN secured hub deployments
Correct answer: The policy is managed by Azure Firewall Manager and routes are auto-managed by the hub
In a Virtual WAN secured hub, Azure Firewall Manager automatically manages routing so traffic flows through the firewall, unlike standard VNet deployments where UDRs must be manually configured.
Question 2: A security engineer needs to allow traffic to a set of Azure PaaS services from a firewall without listing individual IP ranges. Which feature in an application rule should be used?
- IP Groups
- FQDN Tags for Azure services (e.g., 'AzureKubernetesService') (Correct answer)
- Wildcard FQDNs
- Service Endpoints in the rule
Correct answer: FQDN Tags for Azure services (e.g., 'AzureKubernetesService')
FQDN Tags for Azure services (like 'AzureKubernetesService', 'HDInsight', 'WindowsVirtualDesktop') automatically represent all required FQDNs for those services in application rules.
Question 3: What is the effect of setting Threat Intelligence mode to 'Alert Only' in an Azure Firewall Policy?
- Matching traffic is blocked and an alert is sent to Security Center
- Matching traffic is allowed but an alert is logged (Correct answer)
- Matching traffic is quarantined pending review
- Threat Intelligence rules are disabled entirely
Correct answer: Matching traffic is allowed but an alert is logged
In 'Alert Only' mode, traffic matching threat intelligence indicators is allowed to pass but a log entry (alert) is generated for visibility without blocking.
Question 4: A company needs Azure Firewall to inspect outbound web traffic and block access to specific URL categories like gambling and social media. Which Azure Firewall Premium feature provides this?
- IDPS signature filtering
- Web Category filtering (Correct answer)
- Threat Intelligence blocking
- Application rule FQDN wildcards
Correct answer: Web Category filtering
Web Category filtering in Azure Firewall Premium allows administrators to allow or deny outbound traffic based on URL categories such as gambling, social media, or adult content.
Question 5: When configuring a DNAT rule in Azure Firewall Policy, which field specifies where the translated traffic should be delivered?
- Source Address
- Destination Address
- Translated Address and Translated Port (Correct answer)
- Protocol
Correct answer: Translated Address and Translated Port
In a DNAT rule, the 'Translated Address' and 'Translated Port' fields define the internal destination IP and port where inbound traffic is forwarded after translation.
Question 6: An organization deploys Azure Firewall Standard but later needs TLS Inspection and IDPS. What is the recommended migration path?
- Delete and redeploy the firewall as Azure Firewall Premium
- Upgrade the existing firewall SKU to Premium in-place using the Azure Portal or CLI (Correct answer)
- Enable Premium features by attaching a Premium policy to the Standard firewall
- Deploy a second Premium firewall alongside the Standard firewall
Correct answer: Upgrade the existing firewall SKU to Premium in-place using the Azure Portal or CLI
Azure Firewall supports in-place SKU migration from Standard to Premium, preserving the existing firewall configuration while unlocking Premium features.
Question 7: Which Azure Firewall Policy rule collection action causes matching traffic to be silently discarded without sending a TCP reset to the source?
- Deny (Correct answer)
- Drop
- Reject
- Block
Correct answer: Deny
Azure Firewall's 'Deny' action drops matching packets without sending a TCP RST, resulting in a connection timeout at the source rather than an immediate rejection.
AZ-800 Azure Firewall Policies 5
An Azure Firewall Policy is configured in a Virtual WAN secured hub.
What is different about this deployment compared to a standard VNet hub deployment?