AZ-700 Question 289
Select 2You have deployed an Azure Firewall in a hub virtual network (VNet), with a web server located in a spoke VNet. You need to allow inbound HTTPS traffic from the public internet to this web server on port 443, and also allow the web server to make outbound requests on port 443 to a third-party service. Which two actions should you take to successfully configure these requirements for Azure Firewall?
- A
Create a DNAT rule mapping the Azure Firewall public IP address on TCP port 443 to the web server� private IP address on TCP port 443.
- B
Add a network rule collection allowing inbound traffic from Any to the Azure Firewall public IP on port 443.
- C
Implement an application rule collection permitting outbound access on port 443 from the web server� subnet to the third-party domain or IP address.
- D
Enable forced tunneling in the Azure Firewall settings to route all outbound traffic through the on-premises network.
Show answer and explanation
Correct answers: A, C
Explanation
To properly configure inbound and outbound policies in Azure Firewall, you must use a DNAT rule to forward incoming traffic from a public IP and port to an internal resource (in this case, the web server). For outbound connections on specific ports or domain names, application rules are used. Network rules alone do not perform port-level NAT for inbound traffic. For more details, refer to Microsoft documentation on DNAT and application rule collections in Azure Firewall: https://learn.microsoft.com/azure/firewall/dnat and https://learn.microsoft.com/azure/firewall/application-rules.
- A. Correct.
Correct. A DNAT rule is required to forward inbound traffic from the internet on port 443 to the internal web server. This ensures connections on the Azure Firewall� public IP are translated to the web server� private IP.
- B. Incorrect.
Incorrect. Simply creating a network rule to allow inbound traffic from Any on port 443 to the Azure Firewall IP does not forward that traffic to the web server. Network rules do not handle inbound port translation to internal resources, which requires a DNAT rule.
- C. Correct.
Correct. An application rule collection is needed to allow outbound traffic to the third-party service on port 443. Application rules can filter and allow outbound FQDNs or IP addresses on specified ports from the web server� subnet.
- D. Incorrect.
Incorrect. Forced tunneling is generally used to redirect internet-bound traffic back to on-premises. It is not required here. Proper application rules in Azure Firewall would suffice for allowing outbound connections to the third-party service.