Microsoft Azure Security Engineer Certification Azure Network Security 1 — Questions and Answers
Question 1: Which Azure service provides a managed, stateful, cloud-native firewall with built-in high availability and unrestricted cloud scalability?
- Network Security Group
- Azure Firewall (Correct answer)
- Application Gateway
- Azure Front Door
Correct answer: Azure Firewall
Azure Firewall is a managed cloud-native firewall service that provides stateful packet inspection, FQDN filtering, and threat intelligence.
Question 2: Which Azure service provides browser-based RDP and SSH access to VMs through the Azure portal without requiring public IP addresses on the VMs?
- Azure VPN Gateway
- Azure Bastion (Correct answer)
- Just-in-Time VM Access
- Azure Firewall DNAT rules
Correct answer: Azure Bastion
Azure Bastion is a PaaS service deployed inside your VNet that provides secure RDP/SSH over TLS on port 443 from the Azure portal.
Question 3: Which Azure DDoS Protection tier provides adaptive tuning, attack analytics, and SLA guarantees beyond the free platform protection?
- DDoS Basic
- DDoS Network Protection (Correct answer)
- Application Gateway WAF tier
- Azure Firewall Premium
Correct answer: DDoS Network Protection
Azure DDoS Network Protection provides per-resource adaptive tuning, real-time attack metrics, and a financial guarantee SLA.
Question 4: What is an Application Security Group (ASG) in Azure primarily used for?
- Grouping VNets into peering sets
- Grouping VMs logically so NSG rules can reference the group instead of IPs (Correct answer)
- Defining Azure Firewall rule collections
- Managing WAF policy associations
Correct answer: Grouping VMs logically so NSG rules can reference the group instead of IPs
ASGs let you tag VMs and write NSG rules referencing the tag, eliminating the need to maintain explicit IP address lists.
Question 5: Which Azure feature assigns a private IP address from your VNet directly to a PaaS service, eliminating exposure over the public internet?
- Service Endpoints
- Private Endpoints (Correct answer)
- VNet Integration
- Azure Relay
Correct answer: Private Endpoints
Private Endpoints provision a network interface with a private IP in your VNet that maps to the PaaS service, keeping traffic fully private.
Question 6: Which Azure Firewall rule collection type filters HTTP and HTTPS outbound traffic based on fully qualified domain names?
- Network rules
- Application rules (Correct answer)
- NAT rules
- IP Group rules
Correct answer: Application rules
Azure Firewall application rules inspect HTTP/HTTPS traffic and allow or deny it based on FQDNs with support for wildcard patterns.
Microsoft Azure Security Engineer Certification Azure Network Security 1
Which Azure service provides a managed, stateful, cloud-native firewall with built-in high availability and unrestricted cloud scalability?