AZ-500 Secure networking Practice Question
A company uses Azure Firewall to filter outbound traffic. They want to ensure that all DNS queries from virtual machines in a spoke VNet are routed through the Azure Firewall for logging and inspection. They have already configured the firewall to use a custom DNS server. Which additional Azure Firewall feature must be enabled to ensure that the VMs use the firewall as a DNS proxy?
⚠ Common exam trap
A common mix-up: candidates confuse enabling DNS proxy with simply configuring a custom DNS server on the firewall, or they think that a NAT rule or forwarding rule alone will route DNS traffic through the firewall, but without the DNS proxy feature, the firewall does not listen on port 53 and cannot intercept DNS queries from VMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DNS proxy on the firewall policy
Enabling DNS proxy on the Azure Firewall policy allows the firewall to act as a DNS proxy for the virtual machines in the spoke VNet. When DNS proxy is enabled, the firewall listens on port 53 and forwards DNS queries from the VMs to the configured custom DNS server, ensuring all DNS traffic is logged and inspected. This is required even after setting a custom DNS server on the firewall, as the VMs must be configured to use the firewall's private IP address as their DNS server, and the proxy handles the forwarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable DNS proxy on the firewall policy
Why this is correct
Enabling DNS proxy on the Azure Firewall policy is the correct choice because it makes the firewall's private IP address the DNS server for virtual networks. VMs send DNS queries to the firewall, which then forwards them to the configured DNS server, ensuring that all outbound DNS traffic traverses the firewall for inspection and filtering. This gives a single, consistent path for DNS egress and enables FQDN-based rules to be applied to outbound traffic.
- ✗
Configure a DNS forwarding rule
Why it's wrong here
This option is incorrect because Azure Firewall does not have a feature officially called a DNS forwarding rule. The capability that handles forwarding DNS queries from virtual networks to an upstream DNS server is the DNS proxy feature, which is configured on the firewall policy or the firewall itself. There is no separate rule object named 'DNS forwarding rule' in Azure Firewall, so selecting this option would not achieve the goal.
- ✗
Enable Threat Intelligence DNS logging
Why it's wrong here
Enabling Threat Intelligence DNS logging is incorrect for this scenario because it only generates logs and alerts based on known malicious domains or IP addresses. It does not route, proxy, or control the general flow of DNS traffic through the firewall. While it enhances monitoring and detection, it does not ensure that all outbound DNS queries pass through the firewall for filtering, so it fails to meet the requirement.
- ✗
Create a NAT rule for DNS traffic
Why it's wrong here
Creating a NAT rule for DNS traffic is incorrect because NAT rules are designed to translate the destination IP address and/or port of inbound or outbound packets, not to act as a DNS proxy. A NAT rule could redirect DNS queries to a different destination, but it would not make the firewall intercept and forward DNS queries on behalf of the virtual machines. Furthermore, Azure Firewall uses DNS proxy to handle DNS traffic inspection, not DNAT rules.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.