Correct Answer: No, use Azure Firewall or equivalent for explicit deny rules
Network Security Groups (NSG) typically support allow rules only. Azure Firewall support both allow and deny rules, making them suitable for blocking unwanted IP addresses....
Correct Answer
No, use Azure Firewall or equivalent for explicit deny rules
Why This Answer Is Correct
Network Security Groups (NSG) typically support allow rules only. Azure Firewall support both allow and deny rules, making them suitable for blocking unwanted IP addresses.
This question evaluates your knowledge of Azure Firewall — a core concept tested in Microsoft Certified: Azure Solutions Architect Expert (AZ-305). Understanding Azure Firewall is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You need stateless firewall rules at the subnet level in your Azure Virtual Network. What should you configure?
To inspect and filter all East-West traffic between your Azure VNets and North-South traffic from your VNet to the internet, which centralized security service should you deploy?
To protect your public-facing web applications from DDoS attacks that target the application layer (Layer 7), which feature of Azure Front Door or Application Gateway should you enable?
Which Azure security service allows you to centrally manage and deploy firewall rules across multiple virtual networks and regions using a single management policy?
An organization wants to implement 'Zero Trust' networking and wants to ensure that all internal API traffic is inspected by a central firewall without needing to manage complex 'User Defined Routes' (UDR) for every subnet. Which feature helps automate the routing to the firewall?