Exam AZ-700 topic 4 question 41 discussion

1. App only - fqdn 2. Network or DNAT - tcp ports

"Application" only because FQDN "Network" only because TCP based on source IP address

If we set a DNAT rule (a public source towards a private destination), that also means the connection is allowed.

Based on the documentation for Azure Firewall, filtering by protocol is done via a Network Rule, not DNAT. DNAT rules DNAT rules allow or deny inbound traffic through one or more firewall public IP addresses. You can use a DNAT rule when you want a public IP address to be translated into a private IP address. The Azure Firewall public IP addresses can be used to listen to inbound traffic from the Internet, filter the traffic and translate this traffic to internal resources in Azure. Network rules Network rules allow or deny inbound, outbound, and east-west traffic based on the network layer (L3) and transport layer (L4). You can use a network rule when you want to filter traffic based on IP addresses, any ports, and any protocols. https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

Seems correct. feels like a weird question though