An administrator configures an Azure Firewall Policy to secure outbound traffic from a vir… — Microsoft Azure Administrator (AZ-104)

An administrator configures an Azure Firewall Policy to secure outbound traffic from a virtual network subnet. A virtual machine named VM1 is deployed in the subnet and is routed to the firewall using a user-defined route (UDR) for $0.0.0.0/0$ .

The administrator wants to allow outbound HTTPS traffic from VM1 to `*.github.com` while blocking all other outbound HTTPS traffic.

The Firewall Policy currently contains the following rule collections:
* A network rule collection named Net-RC (Priority 200) containing a rule that allows outbound TCP traffic on port 443 from VM1 to any destination ( $*$ ).
* An application rule collection named App-RC (Priority 100) containing a rule that allows outbound HTTPS traffic from VM1 to the target FQDN `*.github.com`.

During testing, the administrator observes that VM1 can successfully establish HTTPS connections to both `https://github.com` and `https://example.com`.

Which configuration change should the administrator implement to ensure that VM1 can only access `*.github.com` over HTTPS?

Remove the network rule that allows TCP traffic on port 443 from Net-RC.Answer
B
Change the action of the network rule in Net-RC to Deny.
C
Change the priority of App-RC to 300 and the priority of Net-RC to 400.
D
Modify the user-defined route (UDR) in the subnet's route table to change the next hop type of the 0.0.0.0/0 route to Virtual Network Gateway.

Answer

Remove the network rule that allows TCP traffic on port 443 from Net-RC.

Removing the network rule that allows TCP traffic on port 443 is correct because Azure Firewall processes network rules before application rules. When a packet matches an 'Allow' network rule, the processing terminates and the packet is allowed, bypassing all application rules. By removing the network rule, the HTTPS traffic (which is TCP port 443) does not match any network rules, allowing it to be evaluated by the application rules in App-RC where the FQDN *.github.com is permitted and other traffic is blocked by default.

Step-by-Step Solution

Identify the evaluation order of Azure Firewall rules.

Azure Firewall processes rules in the following sequence: DNAT rules first, followed by Network rules, and finally Application rules. This order is absolute.

Understanding the rule processing hierarchy is essential because a match at an earlier stage terminates further processing.

Analyze why the current configuration allows all HTTPS traffic.

The rule in the Net-RC network rule collection allows all TCP port 443 (HTTPS) traffic. Because Network rules are evaluated before Application rules, this network rule matches all outbound HTTPS requests, immediately allowing them and bypassing the more specific FQDN rule in App-RC.

This explains why the VM is able to reach unauthorized domains like example.com.

Determine the necessary change to enforce FQDN filtering.

Remove the general network rule allowing port 443. This causes HTTPS traffic to pass through the network evaluation layer without a match, allowing it to reach the application rules where FQDN filtering is executed.

This ensures that only traffic matching the allowed FQDN (*.github.com) is permitted, while all other HTTPS traffic is blocked by the default deny behavior.

Key Concept

Azure Firewall rule processing hierarchy and evaluation order

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic