Azure AZ-FIREWALL Practice Test

AZ-FIREWALL practice test: what's covered

• Policy
• DNAT
• Network Rules
• Application Rules
• IDPS
• TLS Inspection
• Hub-Spoke

Free AZ-FIREWALL sample questions

1. A security engineer needs to centralize egress inspection for multiple spoke virtual networks during a controlled production rollout. Which response is the BEST fit?

   • A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — with change evidence recorded
   • B. place a separate unmanaged public IP on every spoke subnet — with change evidence recorded
   • C. use only NSGs and skip L7 application controls for internet egress — with change evidence recorded
   • D. peer spokes directly to the internet without a shared security boundary — with change evidence recorded
   Show answer

   Correct: A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — with change evidence recorded is the best answer because hub-spoke with UDRs creates a forced-tunnel inspection point for spoke traffic. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes effective routes, firewall hit logs, and spoke UDR next hop.

2. An administrator must centralize egress inspection for multiple spoke virtual networks while investigating an urgent support case. Which action should be taken first?

   • A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — after confirming scope and ownership
   • B. place a separate unmanaged public IP on every spoke subnet — after confirming scope and ownership
   • C. use only NSGs and skip L7 application controls for internet egress — after confirming scope and ownership
   • D. peer spokes directly to the internet without a shared security boundary — after confirming scope and ownership
   Show answer

   Correct: A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — after confirming scope and ownership is the best answer because hub-spoke with UDRs creates a forced-tunnel inspection point for spoke traffic. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes effective routes, firewall hit logs, and spoke UDR next hop.

3. A company plans to centralize egress inspection for multiple spoke virtual networks during an audit-readiness review. Which design best meets the requirement?

   • A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — using the vendor-supported workflow
   • B. place a separate unmanaged public IP on every spoke subnet — using the vendor-supported workflow
   • C. use only NSGs and skip L7 application controls for internet egress — using the vendor-supported workflow
   • D. peer spokes directly to the internet without a shared security boundary — using the vendor-supported workflow
   Show answer

   Correct: A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — using the vendor-supported workflow is the best answer because hub-spoke with UDRs creates a forced-tunnel inspection point for spoke traffic. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes effective routes, firewall hit logs, and spoke UDR next hop.

4. During troubleshooting, the team must centralize egress inspection for multiple spoke virtual networks after a regional service change. Which next step is most defensible?

   • A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — with least privilege preserved
   • B. place a separate unmanaged public IP on every spoke subnet — with least privilege preserved
   • C. use only NSGs and skip L7 application controls for internet egress — with least privilege preserved
   • D. peer spokes directly to the internet without a shared security boundary — with least privilege preserved
   Show answer

   Correct: A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — with least privilege preserved is the best answer because hub-spoke with UDRs creates a forced-tunnel inspection point for spoke traffic. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes effective routes, firewall hit logs, and spoke UDR next hop.

5. An administrator needs to centralize egress inspection for multiple spoke virtual networks before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — with monitoring and rollback defined
   • B. verify the result using effective routes, firewall hit logs, and spoke UDR next hop — with monitoring and rollback defined
   • C. place a separate unmanaged public IP on every spoke subnet — with monitoring and rollback defined
   • D. use only NSGs and skip L7 application controls for internet egress — with monitoring and rollback defined
   • E. peer spokes directly to the internet without a shared security boundary — with monitoring and rollback defined
   Show answer

   Correct: A and B. deploy Azure Firewall in a hub and route spoke egress through the firewall with UDRs — with monitoring and rollback defined and verify the result using effective routes, firewall hit logs, and spoke UDR next hop — with monitoring and rollback defined are correct because hub-spoke with UDRs creates a forced-tunnel inspection point for spoke traffic. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this Azure Firewall scenario.

Last updated: 2026-10-19

AZ-FIREWALL practice test FAQ

Related practice tests

• Azure AZ-700 practice test
• Azure AZ-104 practice test
• Azure AZ-305 practice test
• Microsoft SC-200 practice test
• Microsoft Sentinel practice test
• Azure AZ-500 practice test