Microsoft Azure Security Engineer Certification Azure Network Security 2

Question 1

Which Azure WAF mode actively blocks requests that match malicious rules rather than just logging them?

Accepted Answer

Prevention mode

Answer

WAF Prevention mode blocks matching requests with a 403 response, while Detection mode only logs the match without blocking.

Question 2

Which Azure Network Watcher feature captures network packets to and from VMs for diagnostics and forensic analysis?

Accepted Answer

Packet Capture

Answer

Network Watcher Packet Capture records raw packets flowing to and from a VM, useful for troubleshooting and security investigations.

Question 3

Which service provides centralized security policy and route management for multiple Azure Firewalls across regions and subscriptions?

Accepted Answer

Azure Firewall Manager

Answer

Azure Firewall Manager centralizes policy authoring and firewall deployment management across hub-and-spoke topologies.

Question 4

Which Azure feature captures source and destination IP, port, protocol, and allow/deny decision for traffic through an NSG?

Accepted Answer

NSG Flow Logs

Answer

NSG Flow Logs record every flow decision made by the NSG and store the data in Azure Storage for analysis.

Question 5

Which combination provides global edge protection against OWASP Top 10 vulnerabilities for geographically distributed web applications?

Accepted Answer

Azure Front Door with WAF policy

Answer

Azure Front Door combined with a WAF policy provides globally distributed inspection and blocking at the edge closest to users.

Microsoft Azure Security Engineer Certification Practice Test