Topic 1 · Question 262

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your Azure environment contains multiple Azure virtual machines.
You need to ensure that a virtual machine named VM1 is accessible from the Internet over HTTP.
Solution: You modify an Azure firewall.
Does this meet the goal?

A. Yes

B. No

Top comment

Community votes:A · 7 (54%)B · 6 (46%)

foreverlearner▲ 63Highly votedApril 26, 2020 05:56 pm

You can either modify a firewall or modify a NSG. For basic allow/deny traffic, NSG is enough. But the same can be achieved with Firewall as well.
"The Azure Firewall service complements network security group functionality. Together, they provide better "defense-in-depth" network security. Network security groups provide distributed network layer traffic filtering to limit traffic to resources within virtual networks in each subscription. Azure Firewall is a fully stateful, centralized network firewall as-a-service, which provides network- and application-level protection across different subscriptions and virtual networks." https://docs.microsoft.com/en-us/azure/firewall/firewall-faq

4 more highly voted comments

lehoang15tuoi▲ 15Highly votedDecember 03, 2020 02:25 pm

Your logic is not clear. To put it simply, both Firewall and NSG can be used to block traffic. Think of them like 2 gates on the same walkway. You open one and close one, can you pass through both? The NSG default rule is blocking all inbound traffic, so if you don’t do anything with it, it doesn’t matter what you do with the firewall.

PhilB1000▲ 14Highly votedJanuary 30, 2020 09:44 pm

https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#what-is-the-difference-between-network-security-groups-nsgs-and-azure-firewall
What is the difference between Application Gateway WAF and Azure Firewall?

The Web Application Firewall (WAF) is a feature of Application Gateway that provides centralized inbound protection of your web applications from common exploits and vulnerabilities. Azure Firewall provides inbound protection for non-HTTP/S protocols (for example, RDP, SSH, FTP), outbound network-level protection for all ports and protocols, and application-level protection for outbound HTTP/S.

NoNotSpam▲ 11Highly votedNovember 07, 2019 06:27 pm

I disagree. The question setup does not mention that azure firewall has been deployed (since it is not deployed by default). If it was not deployed, there is no need to modify it

gtm94▲ 7Highly votedApril 23, 2020 03:46 am

why will u first decide to modify the firewall, explicitly, to give HTTP access? shouldnt u modify the NSG?

Open discussion on ExamTopics ↗