A company is designing a network security architecture for a hub-and-spoke topology. They need to inspect traffic between spokes and the internet, but they do not need to inspect traffic between spokes. They also want to minimize the number of firewalls. What is the most appropriate deployment design?

Deploy a single Azure Firewall in the hub VNet and route spoke internet traffic through it.

Deploy a firewall in each spoke VNet to inspect all traffic.

Deploy Azure Firewall in a separate management VNet and peer it with all spokes.

Use Azure Application Gateway with WAF in the hub to filter all traffic.

A company has multiple Azure Firewalls in different VNets and wants to use Azure Firewall Manager to enforce a common security policy. However, they have a requirement that some VNets need to have different rules. What should they do?

Create a base policy and then create child policies for VNets that need different rules

Use a single policy and apply it to all firewalls

Use Azure Policy to override firewall rules

Create a separate policy for each VNet and manage them individually

A company has multiple VNets in different regions and wants to centralize firewall management. They also need to ensure that traffic between VNets in different regions is inspected. They are considering using Azure Virtual WAN with secure hubs. What is the best approach?

Deploy a single Azure Firewall in one region and route all traffic through it

Deploy Azure Firewall in each VNet and manage them separately

Deploy a secure hub in each region and use Azure Firewall Manager to manage all firewalls

Use Azure Firewall Manager to deploy a firewall in a single hub and peer all VNets to it

An organization plans to deploy Azure Firewall in a hub-and-spoke network topology. Where should the Azure Firewall be placed to align with this architecture?

In a separate management network

Microsoft Certified:Azure Network Engineer Associate

Domain 5Objective 2

Design and Implement Azure Firewall and Azure Firewall Manager AZ-700 Practice Questions (Page 6)

Part of the Design and implement Azure network security services domain, which accounts for 15–20% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

15–20%of the exam

Questions 26–30

26application · medium
A company is designing a network security architecture for a hub-and-spoke topology. They need to inspect traffic between spokes and the internet, but they do not need to inspect traffic between spokes. They also want to minimize the number of firewalls. What is the most appropriate deployment design?
Select an answer first
27expert · hard
A company has multiple Azure Firewalls in different VNets and wants to use Azure Firewall Manager to enforce a common security policy. However, they have a requirement that some VNets need to have different rules. What should they do?
Select an answer first
28expert · hard
A company has multiple VNets in different regions and wants to centralize firewall management. They also need to ensure that traffic between VNets in different regions is inspected. They are considering using Azure Virtual WAN with secure hubs. What is the best approach?
Select an answer first
29foundation · easy
A company requires Azure Firewall to support TLS inspection and IDPS (intrusion detection and prevention system) capabilities. Which Azure Firewall SKU should they select?
Select an answer first
30foundation · easy
An organization plans to deploy Azure Firewall in a hub-and-spoke network topology. Where should the Azure Firewall be placed to align with this architecture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.

Design and Implement Azure Firewall and Azure Firewall Manager AZ-700 Practice Questions (Page 6)

Questions 26–30

A company has multiple Azure Firewalls in different VNets and wants to use Azure Firewall Manager to enforce a common security policy. However, they have a requirement that some VNets need to have different rules. What should they do?

A company has multiple VNets in different regions and wants to centralize firewall management. They also need to ensure that traffic between VNets in different regions is inspected. They are considering using Azure Virtual WAN with secure hubs. What is the best approach?

A company requires Azure Firewall to support TLS inspection and IDPS (intrusion detection and prevention system) capabilities. Which Azure Firewall SKU should they select?

An organization plans to deploy Azure Firewall in a hub-and-spoke network topology. Where should the Azure Firewall be placed to align with this architecture?

Keep studying — Design and implement Azure network security services