Free Microsoft Certified: Azure Network Engineer Associate (AZ-700) Sample Questions

Correct answers: A, B — The hub-side peering has 'Allow gateway transit' disabled.; The spoke VNet's address overlaps with the on-premises network.

• A. Correct. For gateway transit to work, the hub-side peering must have 'Allow gateway transit' enabled. If disabled, the spoke cannot use the hub's VPN gateway even though 'Use remote gateways' is enabled on the spoke peering.
• B. Correct. If the spoke VNet's address space overlaps with the on-premises network, Azure cannot route traffic correctly due to ambiguity, causing connectivity failure.
• C. Incorrect. The Basic VPN gateway SKU does support gateway transit. The limitation is that it does not support BGP or ExpressRoute coexistence, but gateway transit is supported.
• D. Incorrect. The BGP ASN of 65515 is a valid default ASN commonly used in Azure VPN scenarios and does not inherently prevent traffic. Connectivity issues would arise from BGP misconfiguration, not from this specific ASN.
• E. Incorrect. While a user-defined route with next hop 'None' would blackhole traffic to on-premises, it is not the most common cause in this scenario. The typical causes are the gateway transit setting and address space overlap.

Correct answer: A — True

• A. The statement is true because Azure Virtual Network Manager supports connectivity configurations that automatically create and manage VNet peering at scale across multiple VNets in a network group, eliminating the need for manual peering for each pair.
• B. The statement is not false; Azure Virtual Network Manager does have connectivity configurations that automatically create and manage VNet peering at scale, so the correct answer is true.

Correct answer: B — Azure DDoS Protection Standard metrics and mitigation reports in the portal

• A. Incorrect. Microsoft Defender for Cloud attack path analysis identifies potential attack paths and security weaknesses, but it does not provide DDoS-specific monitoring or mitigation reports. It focuses on threat exposure and security posture rather than analyzing DDoS traffic patterns.
• B. Correct. Azure DDoS Protection Standard provides dedicated metrics, alerts, and mitigation reports in the Azure portal. These reports include attack details such as traffic patterns, attack vectors, and mitigation actions taken, making it the appropriate tool for analyzing and reviewing DDoS attack information.
• C. Incorrect. NSG flow logs allow analysis of allowed and denied network flows, including source and destination IPs, but they are not designed for DDoS attack detection or reporting. They lack DDoS-specific mitigation insights.
• D. Incorrect. Azure Monitor activity logs record administrative actions such as configuration changes to DDoS protection settings. They do not analyze traffic patterns or provide mitigation reports for ongoing DDoS attacks.
• E. Incorrect. Connection Monitor assesses the availability and latency of applications across regions, but it does not analyze DDoS attack traffic or provide mitigation reports. It is used for network performance monitoring, not security incident analysis.

Correct answers: A, C, E — Round-trip time and packet loss percentage per hop; A topology view of the path between endpoints; Latency and jitter metrics aggregated over time

• A. Correct. Connection Monitor provides hop-by-hop round-trip time and packet loss percentage, helping diagnose network latency and reliability issues.
• B. Incorrect. Identifying the specific NSG rule that caused a packet drop requires NSG flow logs or NSG diagnostics, not Connection Monitor.
• C. Correct. Connection Monitor offers a topology view of the path between endpoints, displaying the network hops and their sequence.
• D. Incorrect. Determining the application layer protocol blocked by a firewall requires packet inspection or firewall logs, not Connection Monitor.
• E. Correct. Connection Monitor can aggregate latency and jitter metrics over time, providing performance monitoring capabilities.
• F. Incorrect. Detailed packet capture is a separate Network Watcher feature (e.g., packet capture tool), not part of Connection Monitor.

Correct answer: B — False

• A. The statement cannot be considered true because no actual question content was provided, making it impossible to evaluate.
• B. A meaningful true/false assessment requires an actual statement, and since the prompt contains no real exam question, the statement is false.

Correct answer: C — Three /22 subnets (e.g., 10.0.0.0/22, 10.0.4.0/22, 10.0.8.0/22)

• A. A /24 subnet provides only 254 total addresses (251 usable in Azure), which is insufficient to support future growth up to 500 hosts per tier.
• B. A /23 subnet provides 512 total addresses (507 usable), enough for 500 hosts, but the example addresses (10.0.1.0/23, etc.) are not valid /23 network addresses. /23 subnets must align on multiples of 2 in the third octet, so this arrangement is invalid.
• C. A /22 subnet provides 1,024 total addresses (1,019 usable), comfortably supporting up to 500 hosts per tier. The example addresses are valid and properly aligned. This arrangement meets the growth requirement while minimizing wasted IP space compared to larger subnets like /21.
• D. A /21 subnet provides 2,048 total addresses, far more than needed for 500 hosts, wasting significantly more IP space than a /22.

Correct answer: A — A subnet named 'AzureBastionSubnet' with a /27 address range

• A. Correct. Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' and a minimum address range of /27. This configuration meets both naming and size requirements.
• B. Incorrect in this context. While the subnet name 'AzureBastionSubnet' is correct, the /26 address range is larger than the minimum /27, but the question expects the minimal correct configuration. Both A and B are technically valid, but only A represents the exact requirement.
• C. Incorrect. The subnet name must be exactly 'AzureBastionSubnet'. 'BastionSubnet' is not a valid name, even though the /26 address range is sufficient.
• D. Incorrect. The subnet name must be 'AzureBastionSubnet', not 'AzureBastion'. Although /27 is a valid size, the incorrect name makes this option invalid.

Correct answer: D — 1000

• A. Incorrect. The limit for private DNS zones linked to a single VNet is higher than 100. Azure supports linking up to 1000 private DNS zones per VNet.
• B. Incorrect. 250 is not the current maximum; the documented limit per VNet is 1000 private DNS zones.
• C. Incorrect. 500 exceeds the older limit but is still below the current supported maximum of 1000 private DNS zones per VNet.
• D. Correct. According to Azure service limits, a single VNet can be linked to up to 1000 private DNS zones for name resolution.

Correct answers: A, B, C — Deploy the Azure DNS Private Resolver resource within the hub virtual network.; Set up an inbound endpoint on the Private Resolver for spoke VNet queries.; Create a forwarding rule in the Private Resolver for the private DNS zone domains.

• A. Correct. The Azure DNS Private Resolver must be deployed into the hub VNet to act as a managed DNS resolution service for spoke networks. It is the core resource that hosts inbound and outbound endpoints and forwarding rulesets.
• B. Correct. An inbound endpoint provides a private IP address within the hub VNet that can receive DNS queries from spoke VNets. This endpoint is the entry point for queries that need to be resolved by the custom DNS servers.
• C. Correct. A forwarding rule or ruleset defines how DNS queries for specified domains should be handled. In this scenario, it is necessary to forward queries to the custom DNS servers in the hub so that spoke VNets can resolve names correctly.
• D. Incorrect. Linking spoke VNets to private DNS zones is used for Azure Private DNS zone resolution and auto‑registration, not for routing all DNS queries to custom DNS servers through the Private Resolver. This does not replace the need for resolver endpoints and forwarding rules.
• E. Incorrect. Although spoke VNets must ultimately use the inbound endpoint's IP for DNS resolution, this is a VNet configuration step rather than a component of the Azure DNS Private Resolver itself. The question asks for required components of the resolver, and this option describes an external configuration action.
• F. Incorrect. An outbound endpoint is used to forward DNS queries to external or on‑premises DNS servers. In this hub‑and‑spoke design, the custom DNS servers are inside the hub VNet, so no outbound endpoint is needed for spoke VNet resolution.

Correct answers: A, C — A virtual machine network interface (NIC); A public Azure Load Balancer frontend

• A. Correct. A public IP address can be directly associated with a virtual machine's network interface (NIC) to enable inbound and outbound internet connectivity.
• B. Incorrect. An internal Azure Load Balancer uses a private frontend IP and does not support public IP addresses. It is designed for traffic within a virtual network.
• C. Correct. A public Azure Load Balancer frontend can be directly associated with a public IP address to distribute incoming internet traffic to backend resources.
• D. Incorrect. An Azure Application Gateway uses a frontend IP configuration, and the public IP is associated with that configuration rather than directly with the gateway resource itself.
• E. Incorrect. A subnet is a logical division of a virtual network that uses private IP addresses and cannot be directly associated with a public IP address.

Correct answer: B — Local network gateway

• A. Incorrect. A virtual network gateway is the Azure-side VPN endpoint, not the representation of the on-premises network. It is required for the VPN but serves a different purpose.
• B. Correct. A local network gateway defines the on-premises VPN device's public IP address and address prefixes, effectively representing the on-premises network in Azure.
• C. Incorrect. A VPN connection links the virtual network gateway and local network gateway, but it does not represent the on-premises network itself.
• D. Incorrect. An ExpressRoute circuit is used for dedicated private connectivity, not for site-to-site VPN. It is a different service.
• E. Incorrect. VPN client configuration is used for point-to-site VPN connections, allowing individual clients to connect, not for representing an entire on-premises network.
• F. Incorrect. A public IP address resource is assigned to the Azure VPN gateway for internet-facing connectivity, but it does not represent the on-premises network.

Correct answer: A — True

• A. The statement is true because Azure ExpressRoute supports multiple circuit paths and can use different providers or locations for redundancy, which is a best practice for high availability.
• B. The statement is false because Azure ExpressRoute does allow multiple connections for redundancy, meaning the statement is actually true.

Correct answer: B — Configure ExpressRoute FastPath on the circuit, allowing on-premises traffic to bypass the ExpressRoute gateway and go directly to virtual machines in peer spokes.

• A. Incorrect. Using VNet peering with the "Use remote gateways" option allows the spoke to use the hub's gateway for transit, but traffic still traverses the hub gateway and does not bypass it.
• B. Correct. ExpressRoute FastPath improves data path performance by enabling on-premises traffic to bypass the ExpressRoute gateway and go directly to virtual machines in peered VNets, reducing latency for supported scenarios.
• C. Incorrect. Azure Route Server dynamically exchanges routes between NVAs and Azure routing, but it does not alter the data path through the ExpressRoute gateway. Traffic still passes through the gateway.
• D. Incorrect. Azure Virtual WAN centralizes connectivity through a virtual hub, but traffic still passes through the hub's router, not bypassing the ExpressRoute gateway.

Correct answer: B — Enable diagnostic logging on the VPN gateway and analyze logs.

• A. Incorrect. Resetting the virtual network gateway is disruptive, causes temporary outage, and does not help diagnose the root cause (suspected on-premises firewall dropping packets). It is a remediation action, not a first diagnostic step.
• B. Correct. Enabling diagnostic logging on the VPN gateway is non-intrusive and provides logs to analyze dropped packets, IKE/IPsec events, and traffic patterns. This can confirm whether packets reach Azure or are dropped on-premises, making it the best first step with minimal impact.
• C. Incorrect. Recreating the connection with a different shared key requires reconfiguration and downtime. A shared key mismatch typically prevents tunnel establishment, not intermittent packet loss while status is 'Connected'. This does not diagnose the suspected firewall issue.
• D. Incorrect. Changing the gateway SKU is a resource-intensive change that addresses throughput, not packet loss from an on-premises firewall. It is not a diagnostic step and does not identify the cause with minimal impact.

Correct answer: A — Create a connection and configure the IPsec/IKE policy properties on the connection resource.

• A. Correct. In Azure, custom IPsec/IKE policy settings are applied directly to the VPN connection resource. You specify the IKE version, encryption, integrity, and DH group as properties of the connection when creating or modifying it. No separate policy object is required.
• B. Incorrect. Azure does not use a separate IPsec/IKE policy object that is linked to the connection. The custom policy is defined inline on the connection resource using its `ipsecPolicies` or `ikePolicy` properties.
• C. Incorrect. The virtual network gateway does not support inheriting custom IPsec/IKE policies to all connections. Each VPN connection has its own policy settings, and they are not configured at the gateway level.
• D. Incorrect. The local network gateway represents on-premises address prefixes and gateway IP, not IPsec/IKE policy. Custom policies are not propagated from the local network gateway to the VPN connection.

Correct answer: A — Anycast

• A. Correct. Azure Front Door uses Anycast to advertise the same IP address from multiple global edge locations, enabling the network to direct client traffic to the nearest available POP. This reduces latency and improves global availability.
• B. Incorrect. Unicast is a one-to-one communication method where a single sender transmits data to a single receiver. It does not inherently support proximity-based routing to the nearest POP.
• C. Incorrect. Multicast sends traffic from one source to multiple selected recipients, which is not how Azure Front Door routes client requests. Front Door is designed for optimized global ingress, not group delivery.
• D. Incorrect. Broadcast sends traffic to all hosts within a network segment, which is unsuitable for Internet-scale traffic routing. Azure Front Door does not use broadcast to direct clients to edge POPs.

Correct answers: A, B — Performance; Priority

• A. Correct. Performance routing directs users to the nearest healthy endpoint based on latency, satisfying the requirement for routing users to the nearest endpoint. Combined in a nested profile, it can be used within a priority structure to provide regional failover.
• B. Correct. Priority routing allows you to define a primary endpoint and one or more failover endpoints. When nested with Performance routing, you can achieve both nearest-endpoint routing and primary/secondary failover.
• C. Incorrect. Weighted routing distributes traffic based on assigned weights; it does not route to the nearest endpoint nor provide health-based failover semantics.
• D. Incorrect. Geographic routing directs traffic based on the user's geographic location, not latency, and does not support configurable primary/secondary failover.
• E. Incorrect. Multivalue routing returns multiple healthy endpoints in a DNS query but does not provide nearest-endpoint selection or a defined failover order.
• F. Incorrect. Subnet routing maps source IP ranges to specific endpoints and is not suitable for latency-based routing or active/passive failover patterns.

Correct answers: B, C, E — Terminating SSL/TLS to offload encryption from backend servers; Routing traffic based on the URL path to different backend pools; Protecting web apps from common vulnerabilities with a web application firewall

• A. Incorrect. Global load balancing across multiple Azure regions is a capability of Azure Traffic Manager or Azure Front Door, not Azure Application Gateway. Application Gateway is a regional load balancer that operates within a single region.
• B. Correct. Azure Application Gateway can terminate SSL/TLS connections at the gateway, offloading the CPU-intensive encryption and decryption work from backend servers. This improves backend performance and simplifies certificate management.
• C. Correct. Azure Application Gateway supports URL-based routing, allowing traffic to be sent to different backend pools based on the path in the request. This is a core Layer 7 routing capability.
• D. Incorrect. OAuth2 authentication and authorization are not natively supported by Azure Application Gateway. Identity and access control are typically handled by application code or services such as Azure AD/Entra ID, not by the gateway itself.
• E. Correct. Azure Application Gateway includes a Web Application Firewall (WAF) that protects web applications from common vulnerabilities such as SQL injection and cross-site scripting. This is a major security feature.
• F. Incorrect. Caching static content at edge locations worldwide is a capability of Azure Front Door or Azure CDN, not Azure Application Gateway. Application Gateway does not provide global edge caching.

Correct answer: D — Enable the X-Forwarded-For header in the rewrite rule set

• A. Incorrect. Setting the backend port to 8080 only changes the port for backend communication and does not forward the original client IP address.
• B. Incorrect. Enabling the 'Override with new host name' option modifies the Host header sent to the backend, but does not preserve the original client IP address.
• C. Incorrect. Enabling 'Pick host name from backend target' dynamically sets the Host header based on the backend target; it does not forward the client IP address.
• D. Correct. Application Gateway can add the X-Forwarded-For header to convey the original client IP to the backend. This is the standard way to pass the client IP through the gateway for logging or inspection by the backend.
• E. Incorrect. Configuring the listener does not control forwarding the client IP via a custom header. Header insertion is handled by rewrite rules or the gateway's built-in forwarded headers, not by the listener itself.
• F. Incorrect. Using HTTPS for the backend connection encrypts traffic but does not preserve the client IP. The backend will still see the Application Gateway as the source unless X-Forwarded-For or a similar header is used.

Correct answer: B — Routing rule

• A. Incorrect. A listener accepts incoming traffic on a specific IP address, port, and protocol, but it does not evaluate or route requests to backend pools. Its role is to receive the request and pass it along for rule processing.
• B. Correct. The routing rule evaluates the incoming request and determines how it should be handled, including which backend pool it should be forwarded to. It ties together the listener, backend pool, and HTTP settings to define the request-routing behavior, such as path-based or host-based routing.
• C. Incorrect. A backend pool is a collection of backend servers that serve the request. It does not evaluate or route requests; it is the destination for routed traffic.
• D. Incorrect. HTTP settings define how Application Gateway communicates with the backend, such as port, protocol, and session affinity. They do not make the routing decision about which backend pool to use.

Correct answer: B — HTTP health probe with custom path

• A. Incorrect. A TCP health probe only verifies that the target port is open and accepting connections; it cannot validate application-level responses or HTTP status codes. In this scenario, a VM could still be marked healthy even if the web app is returning errors.
• B. Correct. An HTTP health probe can request a specific path and evaluate the HTTP response status code, allowing the load balancer to perform an application-level check. This ensures only VMs returning the expected status code are marked healthy.
• C. Incorrect. An ICMP health probe only checks if the VM is reachable via ping; it does not inspect HTTP responses or status codes. ICMP is not a supported Azure Load Balancer health probe type for validating web application health.
• D. Incorrect. A UDP health probe checks for UDP port connectivity and cannot verify HTTP application health or HTTP status codes. UDP is connectionless and not suitable for application-layer checks.

Correct answer: C — Layer 4

• A. Incorrect. Layer 2 (Data Link Layer) deals with MAC addresses and local network frame delivery. Azure Load Balancer does not primarily operate at this layer.
• B. Incorrect. Layer 3 (Network Layer) handles IP routing and addressing. Azure Load Balancer is not primarily a Layer 3 service; its core functionality is at a higher layer.
• C. Correct. Azure Load Balancer operates at Layer 4 (Transport Layer), distributing traffic based on TCP/UDP ports and IP addresses. It provides high-performance, low-latency load balancing without inspecting application content.
• D. Incorrect. Layer 7 (Application Layer) is used by services like Azure Application Gateway for HTTP/HTTPS-aware routing. Azure Load Balancer does not perform application-layer inspection.

Correct answer: C — Configure origin to use a Key Vault certificate and enable validation.

• A. Incorrect. A Front Door managed certificate is used for securing the client-to-Front Door custom domain endpoint, not for origin server validation. The origin must present its own certificate matching the origin's domain name.
• B. Incorrect. Azure Front Door does not support uploading custom certificates for origin validation. The origin server must present a valid certificate that matches the origin domain name; Front Door validates it during the backend TLS handshake.
• C. Correct. To ensure encrypted traffic between Front Door and the origin with a certificate matching the origin's domain name, configure the origin to present a valid certificate, often stored in Azure Key Vault. Enable origin certificate validation in Front Door to verify the certificate during TLS negotiation.
• D. Incorrect. Disabling origin certificate validation would allow connections without verifying the origin's certificate, which does not meet the requirement of using a valid certificate matching the origin's domain name. Validation must be enabled to enforce certificate trust.

Correct answer: D — Use Azure CLI to run a script that iterates through all subnets and enables the endpoint.

• A. Incorrect. Configuring each subnet individually through the Azure portal is time-consuming and not scalable, especially when multiple subnets span multiple virtual networks. Automating the task is more efficient.
• B. Incorrect. Azure Policy can enforce or audit compliance but cannot directly enable service endpoints. Moreover, it would affect all subnets matching a condition, not just the three specified subnets.
• C. Incorrect. Service endpoint policies are used to filter access to Azure services from subnets, not to enable the service endpoint itself. They do not enable the endpoint on the subnet.
• D. Correct. Using Azure CLI to run a script that iterates through the subnets and enables the service endpoint is the most efficient method. It automates the process across multiple virtual networks, reduces manual effort, and ensures consistency.

Correct answer: A — Service endpoints only apply to traffic from the VNet subnet and do not extend to on-premises.

• A. Correct. Service endpoints are designed to secure and optimize traffic from Azure VNet subnets to Azure services, not from on-premises networks. Even with a VPN, on-premises traffic does not originate from the subnet where the service endpoint is enabled, so the service endpoint does not apply. On-premises servers would still use the public endpoint unless Private Link or other private access methods are used.
• B. Incorrect. While an on-premises firewall could block access, the core issue here is that service endpoints do not apply to on-premises traffic at all. The storage account public endpoint may be reachable, but the service endpoint-based access is restricted to Azure VNet-originated traffic.
• C. Incorrect. BGP route propagation is relevant for exchanging routes over a VPN, but it does not make service endpoints work for on-premises servers. Service endpoints do not rely on BGP and do not propagate to on-premises networks.
• D. Incorrect. Service endpoints are configured on subnets, not on the VPN gateway subnet. Enabling a service endpoint on the gateway subnet would not forward on-premises traffic through the feature. The limitation is that service endpoints only apply to Azure subnets where they are configured.

Correct answers: B, E, F — A standard internal load balancer with a frontend private IP.; The Private Link service resource referencing the internal load balancer.; A private endpoint deployed in the consumer's virtual network.

• A. Incorrect. A Private Link service is exposed through a standard internal load balancer with a private frontend IP, not a public IP. Using a public IP would expose the service publicly and does not match the Private Link architecture.
• B. Correct. The service side of Azure Private Link requires a Standard internal load balancer with a private frontend IP address. This load balancer is referenced by the Private Link service to reach the provider's backend service.
• C. Incorrect. While subnets are used in the overall design, Azure Private Link service does not require a virtual network with at least two subnets. The private endpoint is created in the consumer's VNet, and the provider's side is centered on the internal load balancer; they can be in the same subnet.
• D. Incorrect. The consumer's virtual network does not need to be in the same Azure region as the Private Link service. Private endpoints can connect to supported Azure services across regions, depending on the service and configuration.
• E. Correct. The Private Link service resource is the Azure resource that references the internal load balancer on the provider side. It publishes the service privately so that consumers can establish private endpoints to it.
• F. Correct. A private endpoint is created in the consumer's virtual network to privately connect to the Private Link service. This resource maps a private IP in the consumer VNet to the service exposed by the provider.

Correct answer: B — Internal Load Balancer

• A. Incorrect. A Public Load Balancer has a public IP address and is used for internet-facing traffic. It is not suitable for private endpoints because it exposes traffic to the public internet.
• B. Correct. An Internal Load Balancer uses a private IP address and is required for Azure Private Link services. It ensures traffic remains within the virtual network and does not traverse the public internet.
• C. Incorrect. Although an Application Gateway can be deployed with a private IP, it is a layer 7 web traffic load balancer. The standard requirement for a Private Link service is a Standard Internal Load Balancer, not Application Gateway.

Correct answer: C — VirtualNetworkServiceEndpoint

• A. Incorrect. The Internet next hop type is used for traffic that leaves the virtual network to reach public endpoints. When a service endpoint is enabled, traffic to Azure Storage is routed over the Microsoft backbone network, not the public Internet.
• B. Incorrect. The VirtualNetwork next hop type is used for traffic within the same virtual network address space. Azure Storage is an Azure service tag, not a destination inside the VNet, so this type does not apply.
• C. Correct. When a service endpoint is enabled for Microsoft.Storage, the effective route to the Azure Storage service tag shows a next hop type of VirtualNetworkServiceEndpoint. This indicates traffic is securely extended from the subnet to the Azure service over the Microsoft backbone network.
• D. Incorrect. The None next hop type would imply no applicable route, but enabling the service endpoint creates an effective route for the service tag, explicitly represented as VirtualNetworkServiceEndpoint.

Correct answer: A — Switch the WAF policy to prevention mode.

• A. Switching to prevention mode enables Azure WAF to actively block requests that match managed rule detections, such as SQL injection. Detection mode only logs threats without blocking them.
• B. A custom WAF rule is unnecessary because the built-in OWASP ModSecurity Core Rule Set (CRS) already includes protection against SQL injection. The issue is the mode, not the rule set.
• C. Geo-filtering restricts traffic based on geographic location, not specific attack patterns like SQL injection. It does not address the root cause.
• D. Increasing the instance count improves scalability and availability but does not change the WAF's behavior in detection mode. The issue is the mode, not capacity.

Correct answer: A — Set the WAF policy to detection mode, review logs, then enable prevention.

• A. Correct. Detection mode logs rule violations without blocking traffic, allowing the team to validate custom rules against real traffic. After reviewing logs and alerts, they can switch to prevention mode once confident the rules work as intended. This is the safest and most direct method for testing.
• B. Incorrect for this scenario. While isolating rules on a test endpoint is safe, detection mode on the production endpoint achieves the same goal more directly and tests against actual production traffic patterns. A separate policy may be useful for broader testing but is not the best approach for the specific requirement of testing before enforcement in the same environment.
• C. Incorrect. Enabling rules in prevention mode directly can block legitimate traffic due to misconfigurations, leading to false positives and potential outages. Testing should never be performed in prevention mode.
• D. Incorrect. Azure Policy is used for governance and compliance auditing, not for testing the behavior or impact of WAF rules on traffic. It cannot validate rule effectiveness or safety.

Correct answer: A — Azure Log Analytics

• A. Correct. Azure Log Analytics is the primary workspace for collecting and querying WAF logs. It integrates with Azure Monitor, supports KQL queries, and provides visualization and security analysis capabilities.
• B. Incorrect. Azure Storage can retain logs for long-term archiving or compliance, but it does not offer the querying and analysis features needed for security analysis. It is not a workspace for interactive log investigation.
• C. Incorrect. Azure Event Hub is used for real-time data streaming to external systems or downstream processing. It is not a workspace for direct log analysis and lacks the built-in querying and analytics experience of Log Analytics.

Correct answer: B — AzureFirewallManagementSubnet

• A. Incorrect. GatewaySubnet is used for virtual network gateways (VPN or ExpressRoute), not specifically required for Azure Firewall forced tunneling deployments.
• B. Correct. When Azure Firewall is deployed with forced tunneling, you must create AzureFirewallManagementSubnet to isolate management plane traffic. This subnet ensures management traffic can bypass the forced tunneling route and reach the internet directly, while data traffic is tunneled on-premises.
• C. Incorrect. AzureFirewallSubnet is required for the Azure Firewall itself, but the question asks for the additional subnet needed specifically for forced tunneling. That additional subnet is AzureFirewallManagementSubnet.
• D. Incorrect. AzureBastionSubnet is used for Azure Bastion to provide secure RDP/SSH access. It is unrelated to Azure Firewall or forced tunneling configurations.

Correct answers: A, B, C — DNAT rules; Network rules; Application rules

• A. Correct. DNAT (Destination Network Address Translation) rules can be created in an Azure Firewall Policy to translate and forward inbound traffic to internal resources.
• B. Correct. Network rules can be created in an Azure Firewall Policy to allow or deny traffic based on source/destination IP addresses, ports, and protocols.
• C. Correct. Application rules can be created in an Azure Firewall Policy to filter outbound HTTP/HTTPS traffic based on fully qualified domain names (FQDN) and other application-layer attributes.
• D. Incorrect. NSG (Network Security Group) rules are not part of Azure Firewall Policy; they are a separate Azure resource used for filtering network traffic to and from Azure resources.
• E. Incorrect. WAF (Web Application Firewall) rules are not part of Azure Firewall Policy; they are associated with Azure Application Gateway or Azure Front Door for protecting web applications.

Correct answer: A — Create an application security group (ASG) for the web tier, assign the web tier VM NICs to it, then create an NSG rule on the business tier subnet allowing inbound HTTPS from the web tier ASG.

• A. Correct. Application Security Groups (ASGs) simplify NSG rule management by grouping VMs logically. Assigning web tier VMs to an ASG and creating an NSG rule on the business tier subnet that allows inbound HTTPS from the ASG avoids managing individual IP addresses and meets the requirement with minimal overhead.
• B. Incorrect. Deploying all VMs in the same subnet and using Windows Firewall rules on each business tier VM increases administrative overhead and is not scalable. It does not leverage Azure's native network security features like NSGs and lacks clean network-level segmentation.
• C. Incorrect. Associating a separate NSG to each business tier VM NIC with explicit allow rules for each web tier VM's private IP address is highly inefficient. It requires manual updates for every change in the web tier and does not scale well, adding unnecessary complexity.
• D. Incorrect. Configuring a site-to-site VPN between the tiers is unnecessary because they are already in Azure and can be secured with NSGs. It adds complexity and cost, and route tables control routing, not fine-grained inbound access, so this does not meet the requirement efficiently.

Correct answer: D — Allow inbound from 'GatewayManager' service tag on destination port 443 to the Bastion subnet.

• A. Incorrect. Azure Bastion requires inbound traffic on port 443, but the source should not be 'Internet'. Management plane traffic uses the GatewayManager service tag, not a broad Internet source.
• B. Incorrect. Port 3389 is used for RDP to target virtual machines, not for Azure Bastion's management plane. Management traffic uses HTTPS on port 443, and 'VirtualNetwork' is not the required source.
• C. Incorrect. The AzureLoadBalancer service tag is used for Azure Load Balancer health probes, not for Bastion management plane connectivity.
• D. Correct. Azure Bastion requires an NSG rule allowing inbound traffic from the GatewayManager service tag on destination port 443 to the Bastion subnet. This enables the management/control plane connectivity necessary for Bastion to operate.