Question

Contoso deploys an Azure Firewall Standard SKU in its hub virtual network. The security team wants the firewall to automatically block outbound traffic to and inbound traffic from known malicious IP addresses and domains published by Microsoft threat feeds, without manually maintaining rule collections. During a maintenance window they also want to be notified about matches but avoid dropping the traffic while they validate the impact. What should they configure to meet the maintenance-window requirement first, then the production requirement?

Accepted Answer

Set threat intelligence-based filtering to 'Alert only' during the window, then change it to 'Alert and deny' for production

Answer

Create a network rule collection denying the Microsoft threat feed, then delete it after the window

Answer

Set the firewall to 'Deny' mode during the window, then switch to 'Learning' mode for production

Answer

Enable IDPS in 'Alert' mode during the window, then switch IDPS to 'Alert and deny' for production