Azure Network Security Flashcards
6 cards from real Microsoft Azure Security Engineer Certification practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Azure Network Security flashcards as text
Which Azure Firewall Premium capability decrypts outbound TLS traffic, inspects it for threats, then re-encrypts it before forwarding?
Answer: TLS inspection
Azure Firewall Premium TLS inspection acts as a transparent proxy that breaks and inspects encrypted sessions using an intermediate CA certificate.
What does the implicit deny rule automatically present at the end of every Azure NSG ensure?
Answer: All traffic not matching a preceding allow rule is blocked
Azure NSGs include an implicit deny-all rule at priority 65500 that blocks any traffic not explicitly permitted by a higher-priority rule.
Which configuration enables automatic failover from an ExpressRoute circuit to a VPN Gateway connection in the same VNet?
Answer: ExpressRoute and VPN Gateway coexistence
Deploying both an ExpressRoute gateway and a VPN gateway in the same VNet enables VPN to serve as a failover path when ExpressRoute fails.
What does Microsoft Defender for Cloud's Just-in-Time (JIT) VM Access feature do to reduce attack surface?
Answer: Creates temporary NSG rules opening management ports only on authorized request
JIT creates time-bound NSG rules that open RDP/SSH ports only for the requesting user's IP, then automatically closes them after expiration.
Which Azure networking resource overrides default system routes to direct subnet traffic through a network virtual appliance or Azure Firewall?
Answer: User-Defined Route (UDR)
User-Defined Routes are applied to subnets and specify a custom next hop for specific IP prefixes, overriding Azure's default routing.
Which Microsoft Defender for Cloud section surfaces hardening recommendations for open management ports, missing NSG coverage, and network security gaps?
Answer: Defender for Cloud Networking recommendations
Defender for Cloud's Networking recommendations section evaluates your network security configuration and provides prioritized remediation steps.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- learn.microsoft.com — Test delivery, retake policy, time limit, score validity, eligibility, renewal, exam information · verified Nov 2026