Examkin

Question

Difficulty: MediumConfigure Azure Firewall

A virtual machine on an internal subnet attempts to establish an outbound HTTPS connection to an external service. The outbound traffic is routed through an Azure Firewall. The firewall is configured with a Network rule collection that permits all outbound TCP traffic on port 443 to any destination, and an Application rule collection that denies access to the target domain of the external service. What is the result of the connection attempt?

  1. The connection is allowed because the Network rule matches first, allowing the traffic and bypassing the evaluation of the Application rule.Answer
  2. B
    The connection is denied because the Application rule has a higher evaluation priority than the Network rule.
  3. C
    The connection is denied because explicit Deny rules in any collection type take precedence over Allow rules.
  4. D
    The connection is allowed because Application rules are only evaluated for HTTP traffic on port 80, not HTTPS traffic on port 443.

Answer

The connection is allowed because the Network rule matches first, allowing the traffic and bypassing the evaluation of the Application rule.
The correct answer is correct because Azure Firewall processes Network rules before Application rules. When the outbound connection matches the Network rule (which allows TCP port 443 traffic to any destination), the firewall allows the connection immediately. Because a match was found in the Network rules, the Application rules are bypassed entirely, meaning the Deny rule for the specific domain is never evaluated.

Step-by-Step Solution

1
Identify the destination port and protocol of the connection attempt.
The traffic is HTTPS, which uses TCP port 443.
Understanding the port and protocol helps determine which firewall rules are candidates for matching.
2
Compare the traffic against the configured rule collections in their order of evaluation.
Network rules are evaluated first. The connection matches the Network rule that allows TCP port 443 traffic to any destination.
Azure Firewall evaluates rule collections in a specific hierarchy: DNAT rules first, then Network rules, and finally Application rules.
3
Determine the final action and whether subsequent rules are evaluated.
The traffic is allowed by the matching Network rule, and evaluation terminates. The Application rule is not evaluated.
Once a match is found in a rule collection type, Azure Firewall applies the rule action and skips the remaining collection types.

Key Concept

Azure Firewall rule processing hierarchy and evaluation order
Estimated Time:1m 30s
Rate this question

Topics

Configure Azure Firewall

More questions from this topic