Microsoft Azure Security Engineer Certification Azure Network Security 2 — Questions and Answers
Question 1: Which Azure WAF mode actively blocks requests that match malicious rules rather than just logging them?
- Detection mode
- Prevention mode (Correct answer)
- Monitoring mode
- Audit mode
Correct answer: Prevention mode
WAF Prevention mode blocks matching requests with a 403 response, while Detection mode only logs the match without blocking.
Question 2: Which Azure Network Watcher feature captures network packets to and from VMs for diagnostics and forensic analysis?
- Connection Monitor
- Packet Capture (Correct answer)
- NSG Flow Logs
- Traffic Analytics
Correct answer: Packet Capture
Network Watcher Packet Capture records raw packets flowing to and from a VM, useful for troubleshooting and security investigations.
Question 3: Which service provides centralized security policy and route management for multiple Azure Firewalls across regions and subscriptions?
- Azure Monitor
- Microsoft Defender for Cloud
- Azure Firewall Manager (Correct answer)
- Azure Policy
Correct answer: Azure Firewall Manager
Azure Firewall Manager centralizes policy authoring and firewall deployment management across hub-and-spoke topologies.
Question 4: Which Azure feature captures source and destination IP, port, protocol, and allow/deny decision for traffic through an NSG?
- Traffic Analytics
- NSG Flow Logs (Correct answer)
- Network Watcher Connection Monitor
- Azure Monitor Diagnostic Settings
Correct answer: NSG Flow Logs
NSG Flow Logs record every flow decision made by the NSG and store the data in Azure Storage for analysis.
Question 5: Which combination provides global edge protection against OWASP Top 10 vulnerabilities for geographically distributed web applications?
- Azure Firewall Premium with IDPS
- Azure Front Door with WAF policy (Correct answer)
- NSG with application security groups
- Azure DDoS Network Protection
Correct answer: Azure Front Door with WAF policy
Azure Front Door combined with a WAF policy provides globally distributed inspection and blocking at the edge closest to users.
Question 6: What is the primary security benefit of using VNet service endpoints for Azure PaaS services?
- Assign private IPs to PaaS services
- Extend VNet identity to PaaS services so access can be restricted to specific VNets (Correct answer)
- Block all public internet access to the PaaS service
- Enable private DNS resolution for the service
Correct answer: Extend VNet identity to PaaS services so access can be restricted to specific VNets
Service Endpoints allow PaaS service firewalls to recognize and allow traffic specifically from designated VNets while blocking others.
Microsoft Azure Security Engineer Certification Azure Network Security 2
Which Azure WAF mode actively blocks requests that match malicious rules rather than just logging them?