An administrator is configuring an Azure Firewall instance named `FW-01` in a virtual netw… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring an Azure Firewall instance named `FW-01` in a virtual network named `VNet-Prod` to control outbound traffic.

The firewall has the following rule collections configured:
* Network Rule Collection `Net-Coll01` (Priority: 200): Allows TCP traffic from source `10.0.1.0/24` to any destination on port 80.
* Network Rule Collection `Net-Coll02` (Priority: 150): Denies TCP traffic from source `10.0.1.0/24` to destination `10.0.2.0/24` on all ports.
* Application Rule Collection `App-Coll01` (Priority: 100): Allows HTTP traffic from source `10.0.1.0/24` to target FQDN `*.microsoft.com`.

A virtual machine with the IP address `10.0.1.4` attempts to establish the following outbound connections:
* Connection 1: To `http://www.example.com` (which resolves to $93.184.216.34$ on port 80)
* Connection 2: To a web server at `10.0.2.5` on port 80

Which of the following statements correctly describe the outcome of these connection attempts? (Select two.)

The connection attempt to `http://www.example.com` is allowed because network rules are processed before application rules, and the traffic matches the allow rule in `Net-Coll01`.Answer
The connection attempt to `10.0.2.5` is denied because `Net-Coll02` is processed before `Net-Coll01` due to its lower priority number.Answer
C
The connection attempt to `http://www.example.com` is denied because application rules are processed before network rules, and `www.example.com` is not allowed by `App-Coll01`.
D
The connection attempt to `10.0.2.5` is allowed because `Net-Coll01` has a higher priority number ( $200$ ) than `Net-Coll02` ( $150$ ) and allows all port 80 traffic.

Answer

The connection to `http://www.example.com` is allowed because network rules take precedence over application rules and match the traffic under the broad TCP rule. The connection to `10.0.2.5` is denied because the rule collection with priority 150 takes precedence over the collection with priority 200.

The connection to `http://www.example.com` is allowed because network rules are processed before application rules. Since the network rule matches any destination on port 80, the traffic is permitted without evaluating the application rules. The connection to `10.0.2.5` is denied because the network rule collection with priority 150 is processed before the collection with priority 200, terminating the traffic before the allow rule can be evaluated.

Step-by-Step Solution

Determine the rule type evaluation order for outbound traffic.

Network rules are evaluated before application rules.

Azure Firewall processes all network rules first. If a match is found in network rules, the application rules are not evaluated.

Evaluate the connection to `http://www.example.com` (IP

93.184.216.34

, port 80).

The traffic matches the allow rule in the network rule collection.

The network rule collection allows all TCP traffic on port 80 to any destination. This matches the traffic, permitting the connection and skipping application rule processing entirely.

Evaluate the priority of the network rule collections for the connection to `10.0.2.5`.

The network collection with priority 150 is evaluated before the one with priority 200.

Lower priority numbers represent higher precedence in Azure Firewall. The deny rule collection is processed first.

Determine the final action for the connection to `10.0.2.5`.

The connection is denied.

Because the deny rule at priority 150 matches the destination IP and port, the traffic is immediately dropped and processing terminates.

Key Concept

Azure Firewall processes rule collections based on type (Network rules before Application rules) and priority order (lower priority numbers represent higher precedence). Matches are terminating.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic