Knowledge check

1.

Contoso's security team needs to prevent Azure-hosted VMs from accessing malware command-and-control domains, even if those domains use dynamically generated hostnames. Which Azure Firewall capability addresses the requirement?

A network rule collection that denies outbound traffic on ports 80 and 443.

Threat-intelligence-based filtering set to Deny mode, which blocks traffic to and from known malicious IPs and domains maintained by Microsoft.

An application rule collection with a wildcard FQDN deny-rule for all .xyz and .top domains.

2.

A Contoso Azure AI agent running in a spoke virtual network makes outbound HTTPS calls to Azure OpenAI endpoints. The security team wants to ensure the agent can only reach authorized Azure OpenAI endpoints and is blocked from reaching any other external AI APIs. Which Azure Firewall rule type enforces blocking external AI APIs?

A network rule collection that allows outbound traffic on port 443 to Azure OpenAI IP ranges.

An application rule collection with FQDN rules that allow the specific Azure OpenAI endpoint hostnames and deny all other external AI service FQDNs.

A threat-intelligence rule that blocks known AI data exfiltration domains.

3.

Contoso deploys Azure Virtual WAN with hub-spoke topology across three regions. The CISO requires all inter-spoke and internet-bound traffic to pass through a central inspection point. What configuration achieves the outcome?

Deploy an Azure Firewall in each spoke virtual network and configure UDRs to route all traffic through the local spoke firewall.

Convert each Virtual WAN hub to a Secured Virtual Hub by deploying Azure Firewall into the hub, then enable routing intent for private and internet traffic.

Create NSG rules on each spoke subnet that deny direct spoke-to-spoke traffic and force routing through an on-premises firewall.

Check your knowledge

Feedback