AZ-800 Azure Firewall Policies 5

Question 1

An Azure Firewall Policy is configured in a Virtual WAN secured hub. What is different about this deployment compared to a standard VNet hub deployment?

Accepted Answer

The policy is managed by Azure Firewall Manager and routes are auto-managed by the hub

Answer

In a Virtual WAN secured hub, Azure Firewall Manager automatically manages routing so traffic flows through the firewall, unlike standard VNet deployments where UDRs must be manually configured.

Question 2

A security engineer needs to allow traffic to a set of Azure PaaS services from a firewall without listing individual IP ranges. Which feature in an application rule should be used?

Accepted Answer

FQDN Tags for Azure services (e.g., 'AzureKubernetesService')

Answer

FQDN Tags for Azure services (like 'AzureKubernetesService', 'HDInsight', 'WindowsVirtualDesktop') automatically represent all required FQDNs for those services in application rules.

Question 3

What is the effect of setting Threat Intelligence mode to 'Alert Only' in an Azure Firewall Policy?

Accepted Answer

Matching traffic is allowed but an alert is logged

Answer

In 'Alert Only' mode, traffic matching threat intelligence indicators is allowed to pass but a log entry (alert) is generated for visibility without blocking.

Question 4

A company needs Azure Firewall to inspect outbound web traffic and block access to specific URL categories like gambling and social media. Which Azure Firewall Premium feature provides this?

Accepted Answer

Web Category filtering

Answer

Web Category filtering in Azure Firewall Premium allows administrators to allow or deny outbound traffic based on URL categories such as gambling, social media, or adult content.

Question 5

When configuring a DNAT rule in Azure Firewall Policy, which field specifies where the translated traffic should be delivered?

Accepted Answer

Translated Address and Translated Port

Answer

In a DNAT rule, the 'Translated Address' and 'Translated Port' fields define the internal destination IP and port where inbound traffic is forwarded after translation.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Azure Firewall Policies 5