An administrator is configuring outbound traffic filtering in a hub-and-spoke virtual netw… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring outbound traffic filtering in a hub-and-spoke virtual network topology in Microsoft Azure. The hub virtual network (`VNet-Hub`) contains an Azure Firewall instance deployed in `AzureFirewallSubnet` with a private IP address of $10.10.1.4$ and a public IP address of $20.50.100.10$ . The spoke virtual network (`VNet-Spoke`) contains `Subnet-App` ( $10.20.1.0/24$ ) hosting a virtual machine named `VM-App` ( $10.20.1.5$ ). `VNet-Hub` and `VNet-Spoke` are peered.

The administrator configures a route table named `RT-Spoke` associated with `Subnet-App` with a default route ( $0.0.0.0/0$ ) pointing to $10.10.1.4$ as a Virtual Appliance next hop.

To restrict `VM-App` outbound access, the administrator configures the following Azure Firewall rules:
- Network Rule Collection (`Net-RC`): Priority $200$ , Action: Allow, Source: $10.20.1.0/24$ , Protocol: TCP, Destination Port: $443$ , Destination IP: $*$
- Application Rule Collection (`App-RC`): Priority $300$ , Action: Allow, Source: $10.20.1.5$ , Protocol: HTTPS, Target FQDN: `api.partner.com`

During testing, the administrator observes that `VM-App` can successfully access any external HTTPS website, such as `https://www.microsoft.com`, which violates the security policy.

Which of the following actions should the administrator perform to ensure that `VM-App` can only access `https://api.partner.com`?

A
Change the priority of the Network Rule Collection (Net-RC) to $400$ .
Remove the rule from the Network Rule Collection (Net-RC).Cevap
C
Change the next hop type of the route in the RT-Spoke route table to Virtual Network Gateway.
D
Modify the route in the RT-Spoke route table to use the public IP address $20.50.100.10$ as the next hop IP address.

Cevap

The administrator should remove the rule from the Network Rule Collection (Net-RC).

The correct action is to remove the rule from the Network Rule Collection (Net-RC). Azure Firewall processes Network rules before Application rules. If a Network rule matches and allows traffic, the Application rules are never evaluated. Since the current Network rule allows all TCP port

443

traffic to any destination, it matches all HTTPS requests and permits them, bypassing the FQDN filtering in the Application rules. Removing this rule allows the HTTPS traffic to be evaluated by the Application rules, which correctly restricts access to the specified partner API.

Adım Adım Çözüm

Identify the order in which Azure Firewall processes rule collections.

Azure Firewall processes rules in the following order: DNAT rules, Network rules, and then Application rules.

Understanding the evaluation sequence is essential to trace how a packet matches firewall rules.

Determine which rule matches the outbound HTTPS traffic first.

The Network Rule Collection (Net-RC) has a rule allowing all TCP port

443

traffic to any destination (

*

). Since HTTPS uses TCP port

443

, this network rule matches the traffic first.

Network rules are evaluated before Application rules. If a match is found in the network rules and the action is Allow, the traffic is permitted immediately.

Analyze why the Application Rule Collection (App-RC) is not enforcing the FQDN restriction.

Because the Network rule allowed the TCP port

443

traffic, the Application rules are bypassed entirely.

Azure Firewall stops rule processing once an Allow match is found in the Network rules, preventing downstream Application rules from being evaluated.

Formulate the correct modification to enforce the security policy.

Removing the rule from the Network Rule Collection (Net-RC) forces the firewall to evaluate the Application rules, where the request to `api.partner.com` will match the allow rule and all other HTTPS requests will be denied.

Traffic must fail to match any Network rules in order to reach the Application rules evaluation phase.

Anahtar Kavram

Azure Firewall rule processing order (Network rules are processed before Application rules, and matching network rules bypass application rules)

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru