Examkin

Question

Difficulty: EasyConfigure Azure Firewall

An administrator is configuring inbound internet access to an internal web server through an Azure Firewall. The administrator needs to allow HTTP traffic on port 80 to the web server while ensuring all other inbound traffic is blocked.

Which of the following configurations are required to meet these requirements? (Select two)

  1. Configure a Destination Network Address Translation (DNAT) rule to map the firewall's public IP address to the web server's private IP address.Answer
  2. Associate at least one public IP address with the Azure Firewall to receive the incoming traffic.Answer
  3. C
    Create a Network rule in the firewall to explicitly allow inbound TCP port 80 traffic to the web server's private IP address.
  4. D
    Associate a Network Security Group (NSG) to the AzureFirewallSubnet with an inbound allow rule for TCP port 80.

Answer

To allow inbound HTTP traffic to the internal web server, the administrator must configure a Destination Network Address Translation (DNAT) rule mapping the firewall's public IP address to the web server's private IP, and associate at least one public IP address with the Azure Firewall.
Configuring a Destination Network Address Translation (DNAT) rule translates incoming traffic to the firewall's public IP into the web server's private IP, and associating at least one public IP address provides the necessary entry point for external traffic.

Step-by-Step Solution

1
Identify the traffic direction and required translation.
Since traffic is inbound from the internet to a private IP, Destination Network Address Translation (DNAT) is required.
DNAT maps the public IP of the firewall to the private IP of the web server.
2
Ensure the firewall has a public endpoint to listen on.
The firewall must be associated with at least one public IP address.
Without a public IP address, the firewall cannot receive external internet traffic or apply DNAT rules.
3
Evaluate rule requirements and implicit rules.
No separate Network rule is required because DNAT rules automatically include an implicit allow rule for the translated traffic.
Understanding implicit rules prevents redundant or incorrect firewall rule configurations.

Key Concept

Azure Firewall inbound traffic configuration requires a public IP and a DNAT rule, which automatically creates an implicit allow rule.
Rate this question

Topics

Configure Azure Firewall

More questions from this topic