Design and implement Azure network security services — AZ-700 Practice Quiz

Question 1

Contoso runs a three-tier application in a single subnet: 6 web VMs, 4 application VMs, and 3 database VMs. Security requires that only web VMs can reach the application VMs on TCP 8080, and only application VMs can reach the database VMs on TCP 1433. The subnet may grow with additional VMs of each tier over time. You must minimize the number of NSG rules and avoid maintaining explicit IP address lists as VMs are added. What should you implement?

Accepted Answer

Create three Application Security Groups (asg-web, asg-app, asg-db), assign each VM's NIC to the appropriate ASG, and write NSG rules that reference the ASGs as source and destination.

Answer

Create separate subnets for each tier and write NSG rules using each subnet's address prefix as source and destination.

Answer

Create NSG rules that list the individual private IP addresses of the VMs in each tier as source and destination, updating the lists whenever a VM is added.

Answer

Assign a service tag to each tier of VMs and reference the service tags in the NSG inbound rules.

Question 2

Your company deploys Azure Firewall Standard to control outbound traffic from a spoke virtual network. Server administrators report that Windows Update fails on all VMs because outbound HTTP/HTTPS is denied by default. The Microsoft-hosted update endpoints span many changing FQDNs and CDNs. You must allow Windows Update traffic with the least administrative effort and without manually maintaining a list of URLs. What should you configure?

Accepted Answer

Create an application rule that uses the WindowsUpdate FQDN tag

Answer

Create a network rule allowing TCP 80 and 443 to the Internet service tag

Answer

Create an application rule listing each *.windowsupdate.com and CDN wildcard FQDN manually

Answer

Create a DNAT rule to redirect update traffic to an internal WSUS server

Question 3

Your company is deploying Azure Firewall to protect a small branch-office virtual network that expects a peak throughput of roughly 200 Mbps and around 40 concurrent users. Management wants the lowest-cost firewall SKU that still supports built-in threat intelligence in alert mode. However, the security team notes that the deployment must include a specific companion component for the control plane to function. Which SKU should you choose, and what additional resource is mandatory for it?

Accepted Answer

Azure Firewall Basic SKU, which requires a Firewall Management (Basic Management) public IP in addition to the data-plane public IP

Answer

Azure Firewall Standard SKU, which requires an Azure Firewall Premium policy to enable threat intelligence

Answer

Azure Firewall Basic SKU, which requires an Azure DDoS Network Protection plan on the VNet

Answer

Azure Firewall Premium SKU, which requires a dedicated AzureFirewallManagementSubnet only when forced tunneling is enabled

Question 4

Your company deploys an Azure Firewall (Standard SKU) in a hub virtual network. A web server running on a VM in a spoke VNet has the private IP 10.1.2.10 and listens on TCP 8080. You need to publish this server to the internet so that external clients can reach it via the firewall's public IP on TCP 443, with the firewall translating the traffic to the internal address and port. Which type of Azure Firewall rule should you configure?

Accepted Answer

A DNAT rule that translates the firewall public IP:443 to 10.1.2.10:8080

Answer

A network rule allowing inbound traffic from the internet to 10.1.2.10 on TCP 443

Answer

An application rule with a target FQDN pointing to the web server on port 8080

Answer

An SNAT rule that translates the source of inbound traffic to the firewall public IP

Question 5

Your company runs an Azure Firewall Premium with a firewall policy that contains dozens of network and application rules. Several rules reference the same set of 40 on-premises subnet CIDRs as their source, and this list changes about twice a month. Each time it changes, an engineer must manually edit every affected rule, which is error-prone. You need to centralize this address list so a single update propagates to all rules that use it, while keeping the change scoped to the firewall configuration. What should you implement?

Accepted Answer

Create an IP Group containing the 40 CIDRs and reference it as the source in each rule

Answer

Create a custom service tag in Azure Virtual Network Manager and reference it in the rules

Answer

Add the 40 CIDRs to an Application Security Group and use it as the rule source

Answer

Store the CIDRs in an Azure DNS zone and reference the FQDNs in application rules

Question 6

Contoso manages security for multiple Azure Firewall instances using Azure Firewall Manager. The security team creates a parent firewall policy named 'Corp-Base' that contains rule collection groups blocking known malicious FQDNs and enforcing threat intelligence. Regional teams need their own policies that add region-specific application rules but must not be able to remove or override the corporate blocking rules. You need to design the policy structure so that regional policies automatically include all Corp-Base rules while allowing regional additions. What should you do?

Accepted Answer

Create each regional policy as a child policy that inherits from Corp-Base, then add region-specific rule collection groups to the child policy.

Answer

Copy the Corp-Base rule collection groups into each regional policy manually and add the region-specific rules alongside them.

Answer

Associate Corp-Base and each regional policy to the same firewall, letting Firewall Manager merge the rules automatically.

Answer

Create the regional policies as standalone policies and use an Azure Policy definition to enforce that they contain the Corp-Base rules.

Question 7

Contoso deploys a single Azure Firewall (Standard SKU) with a firewall policy. The policy contains a network rule collection that allows outbound TCP traffic on port 443 to a specific server IP, and an application rule collection that denies HTTPS access to the FQDN 'downloads.contoso-partner.com' (which resolves to that same server IP). A VM behind the firewall initiates an HTTPS session to https://downloads.contoso-partner.com. What is the result?

Accepted Answer

The traffic is allowed because network rules are processed before application rules.

Answer

The traffic is denied because application rules take precedence over network rules.

Answer

The traffic is denied because the implicit deny-all rule is evaluated first.

Answer

The traffic is allowed only if Threat Intelligence mode is set to 'Alert and deny'.

Question 8

Your company runs a secured hub in Azure Virtual WAN protected by Azure Firewall Premium. The security team wants to consolidate all firewall configuration for five regional hubs into a single, centrally managed policy while still allowing each hub to have region-specific network rules that override the shared baseline. Which Firewall Manager configuration approach meets these requirements with the least administrative effort?

Accepted Answer

Create one parent Azure Firewall Policy containing shared rules, then create a child policy per region that inherits the parent and adds region-specific rule collection groups with lower priority numbers.

Answer

Create a separate standalone Azure Firewall Policy for each hub and manually duplicate the shared baseline rules into every policy.

Answer

Create one Azure Firewall Policy and associate it with all five firewalls, adding region-specific rules as classic rules directly on each firewall instance.

Answer

Create one parent policy and configure DNAT rules in the parent so each region inherits identical destination translation without child policies.

Question 9

Your company uses Azure Firewall Premium managed by a single Azure Firewall Policy. Within that policy you have two rule collection groups: 'BaselineRules' (priority 200) containing a network rule collection that denies all traffic to 10.50.0.0/16, and 'AppRules' (priority 300) containing a network rule collection that allows TCP 443 from the workload subnet to 10.50.10.5. Users report that HTTPS connections to 10.50.10.5 are being dropped. You must allow this specific traffic while keeping the broad deny in place for the rest of the range. What should you do?

Accepted Answer

Change the priority of the 'AppRules' rule collection group to a lower number than 'BaselineRules' (for example 100).

Answer

Move the allow rule into an application rule collection instead of a network rule collection.

Answer

Increase the priority number of 'BaselineRules' to 400 so it is evaluated last.

Answer

Add a DNAT rule collection to 'AppRules' to translate the destination address.

Question 10

Your company deploys an Azure Firewall Premium instance to inspect outbound HTTPS traffic from application servers. You configure a firewall policy with TLS inspection enabled on an application rule collection. The intermediate CA certificate must be presented by the firewall to clients so it can decrypt and re-encrypt sessions. What must you configure so the firewall can perform TLS inspection?

Accepted Answer

Store an intermediate CA certificate in an Azure Key Vault and grant the firewall policy's managed identity access to it

Answer

Upload a self-signed leaf (server) certificate directly into the firewall policy's TLS inspection settings

Answer

Add the public root certificate of each destination website to the firewall's trusted root store

Answer

Enable IDPS in alert-and-deny mode, which automatically generates the required inspection certificate

Question 11

Your company runs a hub-and-spoke topology with an Azure Firewall Standard in the hub, managed through an Azure Firewall Policy. Security requires that outbound HTTP/HTTPS traffic from all spoke workloads be blocked to any website categorized as 'Gambling' or 'Social Networking', while allowing all other web browsing. You must implement this with the least administrative effort and without manually maintaining lists of FQDNs. What should you configure?

Accepted Answer

Create an application rule collection with an application rule that uses Web Categories to deny the 'Gambling' and 'Social Networking' categories.

Answer

Create a network rule collection that denies the destination IP ranges published for gambling and social networking sites.

Answer

Enable Threat Intelligence in Deny mode on the firewall policy to block the gambling and social networking categories.

Answer

Upgrade the firewall to the Premium SKU and enable TLS inspection to filter the URLs of the restricted categories.

Question 12

Your company deploys Azure Firewall to protect a hub virtual network. Security requirements now mandate that the firewall must decrypt outbound TLS traffic to inspect payloads for malware signatures and must actively block traffic matching known intrusion signatures. The current deployment uses the Standard SKU. What must you do to meet both requirements?

Accepted Answer

Upgrade the firewall to the Premium SKU and configure TLS inspection along with IDPS in alert-and-deny mode.

Answer

Keep the Standard SKU and enable threat intelligence in Alert and deny mode.

Answer

Keep the Standard SKU and add application rules with FQDN filtering plus web categories.

Answer

Upgrade the firewall to the Basic SKU and enable the DNS proxy feature.

Question 13

Your company deploys an Azure Firewall inside a Virtual WAN secured hub using Firewall Manager. The security team requires that all internet-bound traffic from the firewall itself be forced-tunneled through an on-premises appliance over ExpressRoute for centralized egress inspection. During design, you discover this requirement cannot be met with the current architecture. What is the correct explanation?

Accepted Answer

Forced tunneling of Azure Firewall traffic is not supported when the firewall is deployed in a Virtual WAN secured hub; forced tunneling requires a firewall deployed in a standard (customer-managed) VNet with an AzureFirewallManagementSubnet.

Answer

Forced tunneling is only available on the Basic SKU, so you must downgrade the secured hub firewall to Basic to enable it.

Answer

Forced tunneling requires enabling a 0.0.0.0/0 route in the hub routing intent, which the secured hub blocks by default and cannot be overridden.

Answer

Forced tunneling of the secured hub firewall works only if the hub also hosts a third-party NVA, so you must add one to the hub first.

Question 14

Your company is deploying Azure Firewall to protect a hub virtual network. Security requirements state that all outbound TLS traffic from application servers must be decrypted and inspected for malware, and the firewall must use a signature-based intrusion detection and prevention system (IDPS) that can block known malicious network patterns. The solution should minimize cost while meeting these requirements. Which Azure Firewall SKU should you deploy?

Accepted Answer

Azure Firewall Premium

Answer

Azure Firewall Basic

Answer

Azure Firewall Standard

Answer

Azure Firewall Standard with Threat Intelligence set to Alert and deny

Question 15

Contoso deploys an Azure Firewall Standard SKU in its hub virtual network. The security team wants the firewall to automatically block outbound traffic to and inbound traffic from known malicious IP addresses and domains published by Microsoft threat feeds, without manually maintaining rule collections. During a maintenance window they also want to be notified about matches but avoid dropping the traffic while they validate the impact. What should they configure to meet the maintenance-window requirement first, then the production requirement?

Accepted Answer

Set threat intelligence-based filtering to 'Alert only' during the window, then change it to 'Alert and deny' for production

Answer

Create a network rule collection denying the Microsoft threat feed, then delete it after the window

Answer

Set the firewall to 'Deny' mode during the window, then switch to 'Learning' mode for production

Answer

Enable IDPS in 'Alert' mode during the window, then switch IDPS to 'Alert and deny' for production

Question 16

A support engineer reports that an application server VM (private IP 10.2.1.10) cannot receive inbound HTTPS (TCP 443) connections from an on-premises client (203.0.113.25). The VM has an NSG on its subnet and a second NSG on its network interface. You need to quickly determine whether an NSG rule is blocking the traffic and, if so, which specific rule and which NSG is responsible — without capturing packets or installing agents. Which Azure Network Watcher tool should you use?

Accepted Answer

IP flow verify

Answer

Connection troubleshoot

Answer

Virtual network flow logs

Answer

Effective security rules view

Question 17

Contoso runs a three-tier application in a single virtual network. The web tier VMs must accept inbound HTTPS from the internet, and the app tier VMs must accept inbound TCP 8443 only from the web tier VMs. New web and app VMs are provisioned frequently by an autoscale process, and their private IP addresses change each time. You must design NSG rules that stay accurate as VMs are added or removed, without editing rules on each scaling event. What should you implement?

Accepted Answer

Create two Application Security Groups (asg-web and asg-app), assign VM NICs to the appropriate ASG, and write NSG rules that reference the ASGs as source and destination.

Answer

Create NSG rules that reference the web and app subnet address prefixes as source and destination, and reapply the NSG after every scaling event.

Answer

Use a service tag for the web tier as the source in the app tier NSG rule and the VirtualNetwork service tag as the destination.

Answer

Assign static private IP addresses to every VM and hard-code each address as a source in the NSG security rules.

Question 18

You deploy Azure Bastion into a dedicated AzureBastionSubnet to provide secure RDP/SSH access to VMs in a hub VNet. Your security team requires an NSG on AzureBastionSubnet to satisfy compliance. After associating the NSG, users can no longer connect through Bastion. Which set of outbound rules must the NSG allow to restore Bastion functionality while keeping the NSG in place?

Accepted Answer

Outbound to the VirtualNetwork service tag on ports 3389 and 22, to AzureCloud on port 443, to the VirtualNetwork tag on port 8080/5701, and to Internet on port 80

Answer

Outbound to Internet on port 443 only, since Bastion is a fully managed PaaS service that proxies all traffic through the public endpoint

Answer

Outbound to the GatewayManager service tag on ports 443 and 4443, and inbound from the Internet on port 3389

Answer

No outbound rules are needed because AzureBastionSubnet ignores NSG outbound rules by design

Question 19

Your company runs a hub-spoke topology in Azure. You must enable virtual network flow logs on a spoke VNet named spoke-prod-vnet to capture traffic metadata for compliance auditing and later analysis with Traffic Analytics. Before you can create the flow log resource, which prerequisite must be in place in the same region as the VNet?

Accepted Answer

A Network Watcher instance enabled in the region of the VNet

Answer

A network security group associated with every subnet in the VNet

Answer

A Log Analytics workspace linked to the VNet via diagnostic settings

Answer

An Azure Firewall deployed in the hub with logging enabled

Question 20

Your organization has 40 virtual networks, each containing multiple subnets with NSGs applied at both the subnet and NIC levels. Management wants comprehensive traffic logging with the least administrative overhead, and Microsoft has announced the retirement of the older logging feature. You need to enable flow logging so that a single log target automatically captures traffic for all current and future subnets in each virtual network without configuring logs per NSG. What should you configure?

Accepted Answer

Enable virtual network flow logs on each virtual network

Answer

Enable NSG flow logs on each subnet-level NSG

Answer

Enable NSG flow logs on each NIC-level NSG

Answer

Enable IP flow verify on each virtual machine

More AZ-700 practice