You decide to protect your Azure Virtual Network resources using Azure Firewall. But there are a number of different possible issues with the Firewall. In case of the issue "Threat intelligence alerts

Question

Options

• Ause https as the port: protocol value
• BCreate outbound filtering for 80/443 using application rules.
• Cchange the threat intelligence mode to Alert and Deny.
• DUse authenticated SMTP relay services
• EUse only IPv4 addresses.

• A
  10% (4)
• B
  83% (33)
• D
  3% (1)
• E
  5% (2)

Explanation

The 'Threat intelligence alerts may get masked' issue in Azure Firewall occurs because when application rules process HTTP/HTTPS traffic (ports 80/443), they take priority and can prevent threat intelligence from inspecting that same traffic, masking potential alerts. To mitigate this: (B) Create outbound filtering rules for ports 80 and 443 using application rules - this ensures traffic is inspected at the application layer; and (C) Change the threat intelligence mode to 'Alert and Deny' - this actively blocks and alerts on known malicious traffic rather than just alerting. Authenticated SMTP relay (D) addresses a different issue (SMTP relay blocking), and IPv4-only restriction (E) is irrelevant to this problem.

No community discussion yet for this question.