Microsoft Certified Security Compliance And Identity Fundamentals · Free Practice Question Easy
Question 9
Scenario: The Tivan Group is a prestigious and notoriously powerful group in the galactic community. Responsible for the founding of Knowhere, the Group is considerably wealthy and are often the source of exponential contributions to the galaxy. Taneleer Tivan, the infamous Collector, controls the group and is implementing Microsoft Azure into the company.
The IT team at Tivan Group is planning to utilize Azure Firewall to protect the organizations virtual networks.
Is this feasible?
-
A
Yes
-
B
No
Reveal correct answer
Correct answer: A
Explanation
Yes – It is feasible to use Azure Firewall to protect the organizations virtual networks. Azure Firewall is a managed, cloud-based network security service that protects your Azure virtual network (VNet) resources from attackers.
Azure Firewall
Azure Firewall is a managed, cloud-based network security service that protects your Azure virtual network (VNet) resources from attackers. You can deploy Azure Firewall on any virtual network, but the best approach is to use it on a centralized virtual network. All your other virtual and on-premises networks will then route through it. The advantage of this model is the ability to centrally exert control of network traffic for all your VNets across different subscriptions.
With Azure Firewall, you can scale up the usage to accommodate changing network traffic flows, so you don't need to budget for peak traffic. Network traffic is subjected to the configured firewall rules when you route it to the firewall as the subnet default gateway.
Key features of Azure Firewall
Azure Firewall comes with many features, including but not limited to:
• Built-in high availability and availability zones: High availability is built in so there's nothing to configure. Also, Azure Firewall can be configured to span multiple availability zones for increased availability.
• Network and application level filtering: Use IP address, port, and protocol to support fully qualified domain name filtering for outbound HTTP(s) traffic and network filtering controls.
• Outbound SNAT and inbound DNAT to communicate with internet resources: Translates the private IP address of network resources to an Azure public IP address (source network address translation) to identify and allow traffic originating from the virtual network to internet destinations. Similarly, inbound internet traffic to the firewall public IP address is translated (Destination Network Address Translation) and filtered to the private IP addresses of resources on the virtual network.
• Multiple public IP addresses: These addresses can be associated with Azure Firewall.
• Threat intelligence: Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains.
• Integration with Azure Monitor: Integrated with Azure Monitor to enable collecting, analyzing, and acting on telemetry from Azure Firewall logs.
Use Azure Firewall to help protect the Azure resources you've connected to Azure Virtual Networks.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
