Examkin

Question

Difficulty: MediumConfigure Azure Firewall

An administrator is troubleshooting traffic filtering through an Azure Firewall. The firewall is configured with the following rule collections:

- A Network rule collection named `Net-Coll1` (Priority 200200) with a rule that allows outbound TCP traffic on port 443443 from any source to any destination.
- An Application rule collection named `App-Coll1` (Priority 300300) with a rule that allows HTTPS traffic from any source to `*.microsoft.com`.

An internal virtual machine attempts to access `www.example.com` over HTTPS (TCP port 443443).

Which of the following describes how the Azure Firewall will handle this traffic request?

  1. A
    The traffic is denied because the requested FQDN does not match the allowed pattern in the application rule collection.
  2. The traffic is allowed because the matching network rule is evaluated first, permitting the connection and terminating further evaluation.Answer
  3. C
    The traffic is denied because application rules are evaluated before network rules, and the domain is not in the allowed list.
  4. D
    The traffic is allowed because DNAT rules automatically intercept and permit all outbound HTTPS traffic by default.

Answer

The traffic is allowed because the matching network rule is evaluated first, permitting the connection and terminating further evaluation.
Azure Firewall evaluates rules in a strict hierarchy: DNAT rules first, then Network rules, and finally Application rules. Since the rules are terminating, if a match is found in the Network rules that allows the traffic, the firewall immediately permits the connection. In this scenario, the traffic is TCP port 443443, which matches the Network rule in `Net-Coll1`. The firewall permits the traffic, and the Application rules in `App-Coll1` are not evaluated, bypassing the FQDN restriction.

Step-by-Step Solution

1
Determine the type of traffic flow.
The traffic is outbound (from an internal VM to an external internet domain `www.example.com` over port 443443).
This determines which firewall rule types are applicable, as DNAT only applies to inbound traffic.
2
Apply the Azure Firewall rule processing order.
Evaluate Network rules first, then Application rules.
Azure Firewall follows a strict rule evaluation hierarchy where Network rules are processed before Application rules.
3
Check the Network rule collection for a match.
The connection matches the Network rule in `Net-Coll1` because it is TCP traffic on port 443443 to any destination.
A match in the Network rule is found, and because it is an Allow rule, evaluation terminates immediately and the traffic is allowed.

Key Concept

Azure Firewall rule processing order evaluates Network rules before Application rules. Rules are terminating; once a match is found, further evaluation stops.
Estimated Time:1m 30s
Rate this question

Topics

Configure Azure Firewall

More questions from this topic