Hotspot Question You have an Azure subscription that contains the Azure Firewall policies shown in the following table. The subscription contains the firewalls shown in the following table. The…

Question

Exhibit

Answer Area

• You can use URL filtering on the network rules for VNet1.Yes
• You can use an intrusion detection and prevention system (IDPS) to monitor malicious activity on VNet2.No
• If you configure peering between VNet1 and VNet3, encrypted outbound traffic from VNet3 will be inspected.Yes

Explanation

This question tests understanding of Azure Firewall Policy hierarchy (parent/child relationships), policy inheritance, and how firewall policies are associated with Azure Firewall instances across virtual networks.

Approach. In Azure Firewall Policy, a child policy inherits all rules from its parent policy and cannot override them - parent rules always take precedence. A single firewall policy can be associated with multiple Azure Firewall instances, but each firewall can only have one policy assigned. When evaluating statements, check: (1) whether the firewall's associated policy is a child of another policy (it inherits parent rules), (2) whether a policy is shared across firewalls (allowed), and (3) whether rule collections in a child policy can conflict with or override parent policy rules (they cannot - parent rules are processed first with higher priority). Virtual network associations matter only in determining which firewall (and thus which policy) governs traffic in that VNet.

Concept tested. Azure Firewall Policy inheritance (parent-child hierarchy), rule precedence, policy association with multiple firewall instances, and the relationship between firewalls and their governing virtual networks.

Reference. https://learn.microsoft.com/en-us/azure/firewall-manager/policy-overview#hierarchical-policies

No community discussion yet for this question.