Microsoft Azure Security Engineer Certification Azure Network Security 1

Question 1

Which Azure service provides a managed, stateful, cloud-native firewall with built-in high availability and unrestricted cloud scalability?

Accepted Answer

Azure Firewall

Answer

Azure Firewall is a managed cloud-native firewall service that provides stateful packet inspection, FQDN filtering, and threat intelligence.

Question 2

Which Azure service provides browser-based RDP and SSH access to VMs through the Azure portal without requiring public IP addresses on the VMs?

Accepted Answer

Azure Bastion

Answer

Azure Bastion is a PaaS service deployed inside your VNet that provides secure RDP/SSH over TLS on port 443 from the Azure portal.

Question 3

Which Azure DDoS Protection tier provides adaptive tuning, attack analytics, and SLA guarantees beyond the free platform protection?

Accepted Answer

DDoS Network Protection

Answer

Azure DDoS Network Protection provides per-resource adaptive tuning, real-time attack metrics, and a financial guarantee SLA.

Question 4

What is an Application Security Group (ASG) in Azure primarily used for?

Accepted Answer

Grouping VMs logically so NSG rules can reference the group instead of IPs

Answer

ASGs let you tag VMs and write NSG rules referencing the tag, eliminating the need to maintain explicit IP address lists.

Question 5

Which Azure feature assigns a private IP address from your VNet directly to a PaaS service, eliminating exposure over the public internet?

Accepted Answer

Private Endpoints

Answer

Private Endpoints provision a network interface with a private IP in your VNet that maps to the PaaS service, keeping traffic fully private.

Microsoft Azure Security Engineer Certification Practice Test