Examkin

Question

Difficulty: EasyConfigure Azure Firewall

An organization uses Azure Firewall to secure traffic. The firewall has DNAT rules, network rules, and application rules configured. When processing a connection request, which of these rule types is evaluated first by the firewall?

  1. DNAT rulesAnswer
  2. B
    Network rules
  3. C
    Application rules
  4. D
    The rule with the lowest priority number, regardless of its rule type

Answer

DNAT rules are evaluated first by the firewall.
The correct option is DNAT rules. Azure Firewall rule processing follows a fixed hierarchy: DNAT rules are evaluated first. If a match is found, the firewall translates the destination IP address and port and creates an implicit network rule to allow the translated traffic. Network rules are evaluated second, and application rules are evaluated last.

Step-by-Step Solution

1
Analyze the rule type hierarchy of Azure Firewall.
The built-in evaluation order for Azure Firewall is DNAT rules first, then network rules, and finally application rules.
This static order is hardcoded into the firewall's processing engine to ensure security logic is applied consistently.
2
Determine if collection priority overrides the rule type hierarchy.
Collection priority determines evaluation order within the same type of rules, but cannot override the global rule type sequence.
Therefore, even a network rule with a high priority will be evaluated after all DNAT rules.

Key Concept

Azure Firewall rule processing logic and evaluation order
Rate this question

Topics

Configure Azure Firewall

More questions from this topic