Exam AZ-720 topic 5 question 43 discussion

Actual exam question from Microsoft's AZ-720

Question #: 4
Topic #: 5

A company has an Azure tenant. The company deploys an Azure Firewall named FW1 using the Standard SKU. You configure FW1 using classic firewall rules.
The company creates an application rule collection with the following settings:

Priority: 100 -

Action: Deny -

Rule type: FQDN -

Source type: IP address -
Source: *

Protocol: http:80,https:443 -
Target FQDN: *.cloud.contoso.com
An engineer observes that traffic to console.cloud.contoso.com is still allowed by FW1.
You need to determine why the traffic is allowed.
What should you review?

A. Network rules
B. Application rules
C. Infrastructure rules
D. Web categories

Show Suggested Answer

Suggested Answer: A 🗳️

by [deleted] at Jan. 25, 2023, 12:18 p.m.

Comments

Submit Cancel

cris_exam

2 years, 2 months ago

Selected Answer: A

A si correct, Net rules are processed first then App rules.

upvoted 1 times

...

MO_506

2 years, 5 months ago

A - Answer is correct Application rules are always processed after Network rules, which are processed after DNAT rules regardless of Rule collection group or Rule collection priority and policy inheritance. https://learn.microsoft.com/en-us/azure/firewall/rule-processing

upvoted 3 times

MarshalLaw

2 years, 2 months ago

Thank you for the explanation.

upvoted 1 times

...

[Removed]

2 years, 5 months ago

Answer should be B. More info on: https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

upvoted 1 times

MO_506

2 years, 5 months ago

Answer is A https://learn.microsoft.com/en-us/azure/firewall/rule-processing

upvoted 3 times

...