Azure Firewall for centralized security - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Designing a Centralized Azure Firewall Architecture

You want to centralize network security for multiple Azure virtual networks (VNets) in your organization using Azure Firewall. Which architecture best supports this goal while minimizing management overhead?

A Deploy a single Azure Firewall in a dedicated hub VNet and use VNet peering or VPN Gateway to route traffic from spoke VNets through the firewall.

B Deploy one Azure Firewall in each VNet and manage them separately.

C Use Network Security Groups (NSGs) on each subnet instead of Azure Firewall for centralized control.

D Deploy Azure Firewall only in the on-premises network and route Azure traffic through it.

💡 Hint

Think about a hub-and-spoke model to centralize security controls.

Option A describes the hub-and-spoke architecture where a single Azure Firewall is deployed in a hub VNet. Spoke VNets route traffic through the firewall, enabling centralized security management and reducing overhead.

❓ Configuration

intermediate

Azure Firewall Network Rule Configuration

You configure an Azure Firewall network rule to allow outbound HTTPS traffic to a specific IP range. Which of the following rule configurations correctly allows TCP traffic on port 443 to IP range 192.168.1.0/24?

A Protocol: UDP, Source IP: *, Destination IP: 192.168.1.0/24, Destination Ports: 443

B Protocol: TCP, Source IP: *, Destination IP: 192.168.1.0/24, Destination Ports: 443

C Protocol: TCP, Source IP: 192.168.1.0/24, Destination IP: *, Destination Ports: 443

D Protocol: TCP, Source IP: *, Destination IP: 192.168.1.0/24, Destination Ports: 80

💡 Hint

Remember HTTPS uses TCP port 443 and the destination IP should be the allowed range.

Option B correctly specifies TCP protocol, any source IP, destination IP range 192.168.1.0/24, and destination port 443 for HTTPS traffic.

❓ security

advanced

Azure Firewall Threat Intelligence Mode Behavior

You enable Threat Intelligence-based filtering on Azure Firewall with the mode set to 'Alert'. What is the expected behavior when traffic matches a known malicious IP or domain?

A The firewall blocks the traffic and logs an alert.

B The firewall blocks the traffic without logging.

C The firewall allows the traffic and logs an alert.

D The firewall allows the traffic without logging.

💡 Hint

Consider what 'Alert' mode means for threat intelligence in Azure Firewall.

In 'Alert' mode, Azure Firewall allows traffic but logs alerts for traffic matching known malicious IPs or domains, enabling monitoring without blocking.

❓ service_behavior

advanced

Azure Firewall Logging and Monitoring

Which Azure service must you configure to collect and analyze Azure Firewall logs for traffic and threat intelligence alerts?

A Azure Monitor Logs (Log Analytics Workspace)

B Azure Security Center only

C Azure Active Directory

D Azure DevOps Pipelines

💡 Hint

Think about where logs are stored and analyzed in Azure.

Azure Firewall logs are sent to Azure Monitor Logs via a Log Analytics Workspace for collection and analysis.

✅ Best Practice

expert

Implementing High Availability for Azure Firewall

You want to ensure your Azure Firewall deployment is highly available and resilient to zone failures. Which configuration meets this requirement?

A Use Azure Load Balancer in front of a single Azure Firewall instance.

B Deploy multiple Azure Firewalls in different regions without zone redundancy.

C Deploy Azure Firewall in a single availability zone with zone redundancy disabled.

D Deploy Azure Firewall with zone redundancy enabled across multiple availability zones.

💡 Hint

Consider Azure Firewall's built-in zone redundancy feature.

Enabling zone redundancy deploys Azure Firewall instances across multiple availability zones, providing high availability and resilience to zone failures.