Microsoft AZ-500 Practice Test 35
Question 340
A TCP database connection is denied because a team mistakenly expects an application FQDN rule to cover arbitrary non-HTTP protocols. A review identifies this consequence: A rule defined in the wrong collection may never match the intended traffic. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to use an Azure Policy tag to permit packets at the Azure Firewall data plane.
- The controlled remediation is to allow every outbound TCP port rather than selecting the right rule collection.
- The controlled remediation is to create the smallest correct rule and validate it through Firewall logs.
- The controlled remediation is to assume HTTP application rules govern all raw TCP protocols identically.
Explanation
Correct Answer
C:Test using these records: Firewall rule collection type, protocol, destination FQDN or IP and matched flow logs. Azure Firewall application rules and network rules match different protocol and destination patterns.
Incorrect Answers
A:Use an Azure Policy tag to permit packets at the Azure Firewall data plane. This would not reliably restore the intended security boundary. A rule defined in the wrong collection may never match the intended traffic. The appropriate controlled recovery is: Create the smallest correct rule and validate it through Firewall logs.
B:Allow every outbound TCP port rather than selecting the right rule collection. This would not reliably restore the intended security boundary. A rule defined in the wrong collection may never match the intended traffic. The appropriate controlled recovery is: Create the smallest correct rule and validate it through Firewall logs.
D:Assume HTTP application rules govern all raw TCP protocols identically. This would not reliably restore the intended security boundary. A rule defined in the wrong collection may never match the intended traffic. The appropriate controlled recovery is: Create the smallest correct rule and validate it through Firewall logs.
Question 341
An organization policy has a broadly permissive network rule that matches before a specific desired restriction. Which operator action best meets this technical requirement?
- Review the Firewall Policy hierarchy and priority of groups and rule collections and adjust policy safely.
- Assume a child policy always overrides a parent deny without checking precedence.
- Delete all rule groups to test priority in production.
- Use a VM access review to determine Firewall Policy traffic matching.
Explanation
Correct Answer
A:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Confirm the change against these records: Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Incorrect Answers
B:A broad earlier allow can undermine the intended more restrictive access design. Assume a child policy always overrides a parent deny without checking precedence.
C:Delete all rule groups to test priority in production. The proposed change targets the wrong mechanism or lacks essential validation. Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Relevant evidence is inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
D:A broad earlier allow can undermine the intended more restrictive access design. The intended action is: Review the Firewall Policy hierarchy and priority of groups and rule collections and adjust policy safely.
Question 342
An organization policy has a broadly permissive network rule that matches before a specific desired restriction. Which collection of observations most directly tests the suspected cause?
- The name of a firewall policy without its applied match and request logs.
- Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
- A healthy network interface without the evaluated NSG, route or private endpoint.
- A successful connection to a different address and different service port.
Explanation
Correct Answer
B:These records test the actual Azure Firewall Policy rule collection priority behavior rather than an unrelated dashboard state. Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
D:On its own, that evidence does not prove the specified security control works. In the given case, an organization policy has a broadly permissive network rule that matches before a specific desired restriction.
Question 343
An organization policy has a broadly permissive network rule that matches before a specific desired restriction. Which statement most accurately explains this scenario?
- Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- A network appliance presence guarantees the effective route traverses it.
Explanation
Correct Answer
A:Confirmation depends on Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log. This principle supports the security response: Review the Firewall Policy hierarchy and priority of groups and rule collections and adjust policy safely.
Incorrect Answers
B:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for Azure Firewall Policy rule collection priority. The relevant security behavior is: Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Check evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
C:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for Azure Firewall Policy rule collection priority. The relevant security behavior is: Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Check evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
D:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for Azure Firewall Policy rule collection priority. The relevant security behavior is: Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Check evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Question 344
An organization policy has a broadly permissive network rule that matches before a specific desired restriction. Suppose the operator instead follows this unsafe shortcut: Assume a child policy always overrides a parent deny without checking precedence. What is the principal technical consequence of the mistaken choice?
- Changing a resource description fixes every underlying transport rule.
- A broad earlier allow can undermine the intended more restrictive access design.
- The root problem was using a permitted endpoint reachability test.
- The investigation itself created the pre-existing private DNS or route mismatch.
Explanation
Correct Answer
B:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:Changing a resource description fixes every underlying transport rule. This does not explain the real Azure Firewall Policy rule collection priority weakness after the shortcut. The material failure is: A broad earlier allow can undermine the intended more restrictive access design. Inspect evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
C:The root problem was using a permitted endpoint reachability test. This does not explain the real Azure Firewall Policy rule collection priority weakness after the shortcut. The material failure is: A broad earlier allow can undermine the intended more restrictive access design. Inspect evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
D:The investigation itself created the pre-existing private DNS or route mismatch. This does not explain the real Azure Firewall Policy rule collection priority weakness after the shortcut. The material failure is: A broad earlier allow can undermine the intended more restrictive access design. Inspect evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Question 345
An organization policy has a broadly permissive network rule that matches before a specific desired restriction. A review identifies this consequence: A broad earlier allow can undermine the intended more restrictive access design. Which recovery action restores the intended control and validates its effect?
- Delete all rule groups to test priority in production.
- Use a VM access review to determine Firewall Policy traffic matching.
- Reorder or scope the policy rules and verify accepted and denied traffic.
- Assume a child policy always overrides a parent deny without checking precedence.
Explanation
Correct Answer
C:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Delete all rule groups to test priority in production. This would not reliably restore the intended security boundary. A broad earlier allow can undermine the intended more restrictive access design. The appropriate controlled recovery is: Reorder or scope the policy rules and verify accepted and denied traffic.
B:Use a VM access review to determine Firewall Policy traffic matching. This would not reliably restore the intended security boundary. A broad earlier allow can undermine the intended more restrictive access design. The appropriate controlled recovery is: Reorder or scope the policy rules and verify accepted and denied traffic.
D:Assume a child policy always overrides a parent deny without checking precedence. This would not reliably restore the intended security boundary. A broad earlier allow can undermine the intended more restrictive access design. The appropriate controlled recovery is: Reorder or scope the policy rules and verify accepted and denied traffic.
Question 346
A shared Firewall Policy rule group applies differently than expected after administrators changed collection priority. What is the most defensible Azure security action?
- For this Azure workload, the team should delete all rule groups to test priority in production.
- For this Azure workload, the team should use a VM access review to determine Firewall Policy traffic matching.
- For this Azure workload, the team should review the Firewall Policy hierarchy and priority of groups and rule collections and adjust policy safely.
- For this Azure workload, the team should assume a child policy always overrides a parent deny without checking precedence.
Explanation
Correct Answer
C:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
Incorrect Answers
A:Delete all rule groups to test priority in production. The proposed change targets the wrong mechanism or lacks essential validation. Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Relevant evidence is inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
B:A broad earlier allow can undermine the intended more restrictive access design. Use a VM access review to determine Firewall Policy traffic matching.
D:A broad earlier allow can undermine the intended more restrictive access design. In the given case, a shared Firewall Policy rule group applies differently than expected after administrators changed collection priority.
Question 347
A shared Firewall Policy rule group applies differently than expected after administrators changed collection priority. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
B:These records test the actual Azure Firewall Policy rule collection priority behavior rather than an unrelated dashboard state. The intended action is: Review the Firewall Policy hierarchy and priority of groups and rule collections and adjust policy safely.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a shared Firewall Policy rule group applies differently than expected after administrators changed collection priority.
C:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
D:The more relevant observations are: Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Question 348
A shared Firewall Policy rule group applies differently than expected after administrators changed collection priority. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
Explanation
Correct Answer
D:Confirmation depends on Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log. Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone.
Incorrect Answers
A:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for Azure Firewall Policy rule collection priority. The relevant security behavior is: Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Check evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
B:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for Azure Firewall Policy rule collection priority. The relevant security behavior is: Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Check evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
C:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for Azure Firewall Policy rule collection priority. The relevant security behavior is: Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Check evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Question 349
A shared Firewall Policy rule group applies differently than expected after administrators changed collection priority. Suppose the operator instead follows this unsafe shortcut: Assume a child policy always overrides a parent deny without checking precedence. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that a broad earlier allow can undermine the intended more restrictive access design.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
Explanation
Correct Answer
C:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. The suitable control is: Review the Firewall Policy hierarchy and priority of groups and rule collections and adjust policy safely.
Incorrect Answers
A:The investigation itself created the pre-existing private DNS or route mismatch. This does not explain the real Azure Firewall Policy rule collection priority weakness after the shortcut. The material failure is: A broad earlier allow can undermine the intended more restrictive access design. Inspect evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
B:The failure consists only of retaining valid network flow logs. This does not explain the real Azure Firewall Policy rule collection priority weakness after the shortcut. The material failure is: A broad earlier allow can undermine the intended more restrictive access design. Inspect evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
D:The root problem was using a permitted endpoint reachability test. This does not explain the real Azure Firewall Policy rule collection priority weakness after the shortcut. The material failure is: A broad earlier allow can undermine the intended more restrictive access design. Inspect evidence such as inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Question 350
A shared Firewall Policy rule group applies differently than expected after administrators changed collection priority. A review identifies this consequence: A broad earlier allow can undermine the intended more restrictive access design. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to use a VM access review to determine Firewall Policy traffic matching.
- The controlled remediation is to assume a child policy always overrides a parent deny without checking precedence.
- The controlled remediation is to reorder or scope the policy rules and verify accepted and denied traffic.
- The controlled remediation is to delete all rule groups to test priority in production.
Explanation
Correct Answer
C:Azure Firewall Policy rule evaluation follows documented collection and parent-child precedence, not rule text order alone. Test using these records: Inherited Firewall Policy configuration, rule collection priority, rule match and traffic log.
Incorrect Answers
A:Use a VM access review to determine Firewall Policy traffic matching. This would not reliably restore the intended security boundary. A broad earlier allow can undermine the intended more restrictive access design. The appropriate controlled recovery is: Reorder or scope the policy rules and verify accepted and denied traffic.
B:Assume a child policy always overrides a parent deny without checking precedence. This would not reliably restore the intended security boundary. A broad earlier allow can undermine the intended more restrictive access design. The appropriate controlled recovery is: Reorder or scope the policy rules and verify accepted and denied traffic.
D:Delete all rule groups to test priority in production. This would not reliably restore the intended security boundary. A broad earlier allow can undermine the intended more restrictive access design. The appropriate controlled recovery is: Reorder or scope the policy rules and verify accepted and denied traffic.
