AZ-800 Azure Firewall Policies 5

Question 1

An Azure Firewall Policy is configured in a Virtual WAN secured hub. What is different about this deployment compared to a standard VNet hub deployment?

Accepted Answer

The policy is managed by Azure Firewall Manager and routes are auto-managed by the hub

Answer

Virtual WAN secured hubs do not support application rule collections

Answer

Child policies cannot be associated with Virtual WAN secured hubs

Answer

TLS Inspection is not supported in Virtual WAN secured hub deployments

Question 2

A security engineer needs to allow traffic to a set of Azure PaaS services from a firewall without listing individual IP ranges. Which feature in an application rule should be used?

Accepted Answer

FQDN Tags for Azure services (e.g., 'AzureKubernetesService')

Answer

IP Groups

Answer

Wildcard FQDNs

Answer

Service Endpoints in the rule

Question 3

What is the effect of setting Threat Intelligence mode to 'Alert Only' in an Azure Firewall Policy?

Accepted Answer

Matching traffic is allowed but an alert is logged

Answer

Matching traffic is blocked and an alert is sent to Security Center

Answer

Matching traffic is quarantined pending review

Answer

Threat Intelligence rules are disabled entirely

Question 4

A company needs Azure Firewall to inspect outbound web traffic and block access to specific URL categories like gambling and social media. Which Azure Firewall Premium feature provides this?

Accepted Answer

Web Category filtering

Answer

IDPS signature filtering

Answer

Threat Intelligence blocking

Answer

Application rule FQDN wildcards

Question 5

When configuring a DNAT rule in Azure Firewall Policy, which field specifies where the translated traffic should be delivered?

Accepted Answer

Translated Address and Translated Port

Answer

Source Address

Answer

Destination Address

Answer

Protocol

Question 6

An organization deploys Azure Firewall Standard but later needs TLS Inspection and IDPS. What is the recommended migration path?

Accepted Answer

Upgrade the existing firewall SKU to Premium in-place using the Azure Portal or CLI

Answer

Delete and redeploy the firewall as Azure Firewall Premium

Answer

Enable Premium features by attaching a Premium policy to the Standard firewall

Answer

Deploy a second Premium firewall alongside the Standard firewall

Question 7

Which Azure Firewall Policy rule collection action causes matching traffic to be silently discarded without sending a TCP reset to the source?

Accepted Answer

Deny

Answer

Drop

Answer

Reject

Answer

Block