Question 250
Two network-rule collections in the same Azure Firewall Policy level match the same packet: Allow priority 200 and Deny priority 900. Which precedence adjustment makes the intended Deny take effect?
- Assign meaningful rule priority and test terminating matches.
- Examine parent-before-child policy hierarchy rather than changing only child priority.
- Narrow application-rule FQDN patterns and validate actual intended destinations.
- Account for network-rule precedence over application rules and redesign the policy.
Explanation
Correct Answer
A:The collection containing the Allow has priority 200 (evaluated before 900), so its match terminates processing. Place the intended Deny in a higher-priority collection or narrow the prior Allow, then retest.
Incorrect Answers
B:Parent policy precedence only matters if these rules are in different inherited policy levels; this example places both in the same type and policy level.
C:Refining an unrelated FQDN application rule does not change a network-rule Allow that matched before the later Deny.
D:Network-versus-application precedence is not the issue because the question specifies two network rule collections.
Question 251
A security team needs Azure Firewall to identify and optionally block signature-matching exploits in supported traffic, not merely allow or deny TCP ports. Which supported feature and mode should it configure?
- Enable appropriate supported Firewall Premium IDPS policy and test its mode.
- Examine parent-before-child policy hierarchy rather than changing only child priority.
- Use appropriate Azure Firewall application rules and deny unspecified destinations.
- Inspect allowed FQDN/SNI behavior and the actual client request.
Explanation
Correct Answer
A:Use Azure Firewall Premium with IDPS configured for the required Alert or Alert and Deny mode, test relevant threat signatures and confirm resulting logs/actions.
Incorrect Answers
B:Parent/child rule priority controls policy matching but does not enable signature-based IDPS.
C:An outbound FQDN application rule filters destinations but does not provide signature-based intrusion detection/prevention across supported network traffic.
D:Checking TLS SNI diagnoses hostname policy matching, not whether a threat signature is detected and blocked.
Question 252
Azure Firewall network logs show Allow for a TCP flow, but the VM listener remains unreachable. What independent downstream checks should be made before adding more firewall allows?
- Configure appropriate DNAT and validate back-end forwarding requirements.
- Narrow application-rule FQDN patterns and validate actual intended destinations.
- Trace NSG, UDR, service authorization and backend path separately.
- Account for network-rule precedence over application rules and redesign the policy.
Explanation
Correct Answer
C:An Azure Firewall Allow only means its own policy matched; inspect the actual next hop, NSG, return route, service-side permissions and backend/listener to find the separate subsequent failure.
Incorrect Answers
A:DNAT is for inbound address translation and is not automatically the right fix for a firewall allow followed by a destination NSG or service authorization denial.
B:Changing FQDN wildcard patterns may expand unrelated outbound permissions and cannot explain a packet accepted by this firewall but rejected downstream.
D:Network-rule precedence explains which Azure Firewall rule allowed the flow, not what happened in the backend security layer afterward.
Question 253
An Azure Firewall application allow rule uses a wildcard that permits unrelated external HTTPS domains. Which policy change directly restores least-privilege FQDN access?
- Inspect allowed FQDN/SNI behavior and the actual client request.
- Configure appropriate DNAT and validate back-end forwarding requirements.
- Narrow application-rule FQDN patterns and validate actual intended destinations.
- Account for network-rule precedence over application rules and redesign the policy.
Explanation
Correct Answer
C:Replace the permissive wildcard FQDN with a verified narrow allowlist of approved HTTPS destinations, then test allowed and denied names through the actual application rule.
Incorrect Answers
A:TLS SNI diagnostics can show what the client requested but do not themselves remove overbroad wildcard domain access.
B:DNAT handles inbound address translation; it does not narrow a broad outbound FQDN application rule.
D:Rule-type precedence should be checked if a broad network Allow exists; the stated defect is the application wildcard itself, which must be narrowed.
Question 254
A VM has different NSGs applied at its subnet and NIC. Which NAMED Azure Network Watcher diagnostic shows their combined effective NSG rules for that NIC?
- Inspect Network Watcher effective security rules on the NIC to see combined applied policy.
- Explain AVNM admin-rule precedence from the effective rules output.
- Examine packet flow, backend/listener and transit path before expanding allow rules.
- Examine subnet, NIC and AVNM effective rules, not only the edited rule file.
Explanation
Correct Answer
A:Network Watcher effective security rules display the combined applicable rules for a NIC, including subnet and NIC NSGs, so conflicting priorities can be identified.
Incorrect Answers
B:An AVNM admin-rule explanation is relevant only after evidence indicates an admin security rule is responsible; none is stated here.
C:Packet-path and service-listener checks may be useful later but do not show the requested combined applied NSG rule inventory.
D:Generic review of a single NSG template omits the combined applied subnet- and NIC-level policy that Network Watcher computes for this VM.
Question 255
A VM was moved to a replacement network interface after a deployment. An administrator checks an old NSG object and concludes traffic should be allowed, but tests still fail. Which diagnostic best finds the policy actually applied to the new NIC?
- Export the former NIC’s historical NSG configuration and treat it as proof of what currently applies to the replacement NIC.
- Inspect the replacement NIC’s effective subnet, NIC and security-admin rules, rather than the retired NSG object.
- Examine packet flow, backend/listener and transit path before expanding allow rules.
- Inspect only the detached original NIC’s NSG definition and assume it still governs the VM after the replacement interface was attached.
Explanation
Correct Answer
B:The VM’s replacement NIC may belong to a different subnet or NSG, and central security-admin rules can still apply. Network Watcher effective security rules for the current NIC are the relevant evidence.
Incorrect Answers
A:An old NIC’s NSG definition can be correct for that obsolete interface while the replacement NIC receives a different subnet/NSG/admin combination. Historical configuration is not evidence of current effective policy.
C:Tracing packet/backend behavior may be useful later but is not the correct inventory of effective security rules for the replacement NIC; inspect the currently attached interface first.
D:The detached NIC is not on the packet path. Its saved rule list cannot show which subnet, NIC and central security-admin rules apply to the new interface.
Question 256
A VM loses connectivity to a known destination IP immediately after a user-defined route is changed. The NSG is unchanged. Which Network Watcher diagnostic identifies the effective forwarding next hop?
- Validate DNS and next hop rather than calling it an RBAC failure.
- Inspect effective routes/next hop before changing NSG ports.
- Examine subnet, NIC and AVNM effective rules, not only the edited rule file.
- Export or inspect combined effective security rules for that NIC and relevant context.
Explanation
Correct Answer
B:Use Network Watcher Next hop/effective VM routes for the destination to discover whether a new UDR sends traffic to the wrong NVA, gateway or None before changing NSG ports.
Incorrect Answers
A:DNS diagnostics may help for an FQDN problem, but this packet’s destination IP is already known; inspect its computed next hop first.
C:Expanding the search across subnet/NIC/AVNM security rules is appropriate after ruling out routing, but a route change is the immediate event tied to the outage.
D:NIC effective security rules determine packet filtering, not whether the selected user-defined route has a valid next hop.
Question 257
A team needs an end-to-end TCP reachability result from an Azure VM to a particular destination and port, including possible NSG, route or guest-firewall problems—not just the single NSG rule that matches a packet. Which Azure Network Watcher diagnostic should it run?
- Examine packet flow, backend/listener and transit path before expanding allow rules.
- Export or inspect combined effective security rules for that NIC and relevant context.
- Separate path permission from target identity authorization.
- Run Network Watcher Connection troubleshoot from the source VM to the specified destination IP/port and inspect reachability, hops and detected blocking causes.
Explanation
Correct Answer
D:Use Network Watcher Connection troubleshoot from the intended source VM to the actual destination IP and TCP port to test end-to-end reachability, hop information and potential NSG/UDR/guest-firewall blocking causes.
Incorrect Answers
A:A generic recommendation to inspect the backend path does not provide the named connectivity diagnostic and its reachability/probe outcome required by this scenario.
B:Effective security rules list filters that apply to one NIC; they do not prove delivery across intermediate routing, NSGs and destination listener.
C:Checking application identity is necessary for a post-network 401/403, but does not establish whether TCP packets can reach the intended listening service.
Question 258
After a route-table change, an Azure application VM cannot resolve external names, even though it still authenticates to Azure. Which diagnostics distinguish DNS resolver reachability from an RBAC problem?
- Validate DNS and next hop rather than calling it an RBAC failure.
- Use a supported connectivity/IP-flow diagnostic for the actual five tuple.
- Inspect effective routes/next hop before changing NSG ports.
- Export or inspect combined effective security rules for that NIC and relevant context.
Explanation
Correct Answer
A:Test DNS against the configured resolver, inspect effective next hop/UDR for the resolver and returned address, and repair the broken name-resolution path rather than changing Azure RBAC.
Incorrect Answers
B:IP flow verify can check TCP/UDP security rules for a known packet, but does not prove that the external hostname resolves to the correct address.
C:Inspecting a new UDR’s next hop is necessary for route issues, but the symptom first requires distinguishing DNS failure from packet routing after a name is resolved.
D:Dumping NIC NSG rules may expose blocked DNS traffic but cannot determine a stale DNS forwarder or wrong route without direct DNS and next-hop tests.
Question 259
An auditor has the exact source, destination, port, direction and protocol for a denied packet to a VM. Which Azure Network Watcher test identifies the specific NSG rule responsible for that flow?
- Check whether the VM’s subnet has any NSG attached, then infer the selected rule without supplying the packet five-tuple.
- Run Network Watcher IP flow verify with the real NIC, direction, protocol, source/destination and ports; inspect the matched Allow or Deny rule.
- Inspect only the route-table next hop and assume that a valid route proves which NSG rule accepted or denied the traffic.
- Export the VM’s full effective rule inventory and assume that its first listed NSG entry matched the audited packet.
Explanation
Correct Answer
B:IP flow verify evaluates the specified packet against the VM’s effective NSG decision and identifies the rule that allowed or denied it. This gives audit evidence about this one flow.
Incorrect Answers
A:An NSG being attached is not enough to identify the winning rule; source, destination, direction, protocol and ports determine whether the rule matches.
C:Routes determine next-hop forwarding, while NSG rules determine permitted or denied packets. A next-hop check does not name the matching security rule.
D:An exported rule inventory lists candidates, but without evaluating the actual flow it does not prove which entry matched the packet.
Question 260
An auditor must prove a centrally assigned Virtual Network Manager Deny rule is effective on several production VM interfaces, while local NSG templates show Allow. Which verification should the engineer provide?
- Examine packet flow, backend/listener and transit path before expanding allow rules.
- Separate path permission from target identity authorization.
- Inspect/export Network Watcher effective rules for the actual NICs, including central AVNM security-admin rules, and retain their applicable scope as audit evidence.
- Submit only the local NSG allow-rule template and omit the effective central security-admin rule evaluation.
Explanation
Correct Answer
C:The audit needs deployed effective access evidence for the actual interfaces. Central Virtual Network Manager Deny can override a local NSG Allow; NIC-level effective rules show the applicable decision instead of only intended template state.
Incorrect Answers
A:Packet capture or listener inspection helps troubleshoot delivery, but does not satisfy this audit request to export the effective security-admin/NSG rules on several named NICs.
B:Application authorization is independent of the requested NIC-level evidence that a centralized AVNM security-admin Deny applies before the local NSG Allow.
D:A local Allow rule alone does not establish what the NIC can receive when a central AVNM security-admin Deny applies first. The audit must include the effective inherited policy.
Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests