SC-200 Manage a security operations environment Practice Question
Exhibit
Refer to the exhibit.
```json
{
"properties": {
"displayName": "Block Tor IPs",
"description": "Blocks traffic from known Tor exit nodes.",
"ruleType": "Prevention",
"action": "Block",
"priority": 100,
"sourceAddress": ["138.197.0.0/16", "104.131.0.0/16"],
"destinationAddress": ["*"],
"sourcePorts": ["*"],
"destinationPorts": ["443", "80"],
"protocol": "TCP",
"direction": "Inbound"
}
}
```You are a security analyst for a company that uses Azure Firewall. You are reviewing a custom rule deployed via Azure Firewall Manager. The exhibit shows the rule configuration. The rule is intended to block inbound traffic from known Tor exit nodes. However, a recent incident involved an attacker using a Tor exit node with IP 138.197.5.5 to access an internal web server on port 8080. The log shows the traffic was ALLOWED. What is the most likely reason the rule did not block the traffic?
⚠ Common exam trap
Many candidates assume a rule blocking a source IP will block all traffic from that IP, but Azure Firewall rules require exact port matching, and the rule only specifies port 80, not port 8080.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination port 8080 is not listed in the rule.
The rule is configured to block traffic on destination port 80, but the attacker used port 8080. Azure Firewall rules are explicit; if the destination port in the traffic does not match any port specified in the rule, the rule is not applied, and the traffic is evaluated by subsequent rules or default allow logic. Since the rule only lists port 80, traffic to port 8080 is not matched, and thus the rule does not block it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The destination port 8080 is not listed in the rule.
Why this is correct
The application rule's destination port list is the crux: it only specifies 443 (HTTPS) and 80 (HTTP), so any outbound connection to port 8080 does not match the rule's conditions, even when the destination FQDN or IP is otherwise covered. A matching source and destination are not enough; for an Azure Firewall application rule to apply, the protocol:port must also be present in the rule. Because 8080 is absent, the traffic bypasses this deny action, which explains why the connection was allowed.
- ✗
The source address range does not include 138.197.5.5.
Why it's wrong here
The source IP 138.197.5.5 is within the CIDR range 138.197.0.0/16, which encompasses all addresses from 138.197.0.0 through 138.197.255.255. Therefore the source IP condition is satisfied, not violated, so this explanation for the failure is incorrect. The problem must instead be found in the destination port or another rule property.
- ✗
The rule type is 'Prevention' but should be 'Detection'.
Why it's wrong here
In Azure Firewall, a rule collection action that says 'Prevention' corresponds to a Deny action that actively drops or blocks matching traffic, whereas 'Detection' only produces an alert/log entry without interrupting the connection. For a blocking rule, Prevention is the appropriate and correct action, and changing it to Detection would guarantee the traffic is allowed, not blocked. Thus the rule type as described is not the cause of the issue.
- ✗
The rule priority is too low and is overridden by a higher priority rule.
Why it's wrong here
Rule priority in Azure Firewall uses a lower numeric value to mean higher precedence: priority 100 is evaluated very early, not suppressed by most other rules, and it is only bypassed if a numerically lower (higher-priority) rule matches the traffic and explicitly allows or denies it. Since no such matching higher-priority rule is described, the deny rule is not overridden, and priority 100 cannot explain the failure. The real gap is the missing port 8080 in the destination list.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.