Question

Contoso deploys a single Azure Firewall (Standard SKU) with a firewall policy. The policy contains a network rule collection that allows outbound TCP traffic on port 443 to a specific server IP, and an application rule collection that denies HTTPS access to the FQDN 'downloads.contoso-partner.com' (which resolves to that same server IP). A VM behind the firewall initiates an HTTPS session to https://downloads.contoso-partner.com. What is the result?

Accepted Answer

The traffic is allowed because network rules are processed before application rules.

Answer

The traffic is denied because application rules take precedence over network rules.

Answer

The traffic is denied because the implicit deny-all rule is evaluated first.

Answer

The traffic is allowed only if Threat Intelligence mode is set to 'Alert and deny'.