A network security team needs to inspect and filter outbound HTTPS traffic from Azure virtual machines based on URL categories. Which Azure Firewall feature supports this requirement?

Application rules with FQDN tags

Network rules with IP-based filtering

Application rules with custom FQDNs

Application rules with web categories

During the implementation of Azure Firewall, which step is required to route traffic from a spoke virtual network to the firewall for inspection?

Create a network security group on the spoke subnet

Add a route in the spoke's route table with the firewall's private IP as the next hop

Assign a public IP to the spoke's virtual machines

Enable Azure Firewall Manager on the spoke

An organization has Azure Firewall Premium deployed. They need to allow outbound HTTPS traffic to a specific FQDN but also need to inspect the traffic for threats. They have configured an application rule for the FQDN. What else must they configure to ensure the traffic is inspected?

Configure a DNAT rule for the FQDN

Add a network rule to allow HTTPS to any destination

Enable TLS inspection on the firewall policy

Enable threat intelligence in the application rule

A company is deploying Azure Virtual WAN with a secured hub. They need to inspect traffic between on-premises sites and VNets, and they want to use Azure Firewall Manager to manage the firewall policy. Which resource should they deploy in the Virtual WAN hub?

An Azure Application Gateway with WAF in the hub.

A standalone Azure Firewall in a hub VNet.

A network virtual appliance (NVA) from the Azure Marketplace.

An Azure Firewall as a secured virtual hub.

Contoso runs a hub-and-spoke network with Azure Firewall in the hub. The security team wants to allow outbound HTTPS traffic from the spoke VMs to a specific partner API at api.partner.com, but they must block all other outbound HTTPS traffic. They also need to log the fully qualified domain name (FQDN) that each VM requests. Which rule configuration should you implement?

Add a Network rule with protocol TCP, destination port 443, and destination FQDN api.partner.com.

Add a Network rule with protocol TCP, destination port 443, and destination IP address of api.partner.com.

Add an Application rule with protocol HTTPS, destination FQDN api.partner.com, and action Allow.

Add a DNAT rule that translates the destination to the partner API's IP address on port 443.

Microsoft Certified:Azure Network Engineer Associate

Domain 5Objective 2

Design and Implement Azure Firewall and Azure Firewall Manager AZ-700 Practice Questions (Page 2)

Part of the Design and implement Azure network security services domain, which accounts for 15–20% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

15–20%of the exam

Questions 6–10

6foundation · easy
A network security team needs to inspect and filter outbound HTTPS traffic from Azure virtual machines based on URL categories. Which Azure Firewall feature supports this requirement?
Select an answer first
7foundation · easy
During the implementation of Azure Firewall, which step is required to route traffic from a spoke virtual network to the firewall for inspection?
Select an answer first
8expert · hard
An organization has Azure Firewall Premium deployed. They need to allow outbound HTTPS traffic to a specific FQDN but also need to inspect the traffic for threats. They have configured an application rule for the FQDN. What else must they configure to ensure the traffic is inspected?
Select an answer first
9application · medium
A company is deploying Azure Virtual WAN with a secured hub. They need to inspect traffic between on-premises sites and VNets, and they want to use Azure Firewall Manager to manage the firewall policy. Which resource should they deploy in the Virtual WAN hub?
Select an answer first
10application · medium
Contoso runs a hub-and-spoke network with Azure Firewall in the hub. The security team wants to allow outbound HTTPS traffic from the spoke VMs to a specific partner API at api.partner.com, but they must block all other outbound HTTPS traffic. They also need to log the fully qualified domain name (FQDN) that each VM requests. Which rule configuration should you implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.