AZ-305 Question 220
Single answerYour company operates in multiple Azure regions and requires a centralized network security solution to inspect and control traffic for all virtual networks (VNets). You want to minimize administrative overhead and provide advanced threat protection without deploying a firewall in every VNet. Which design should you implement?
- A
Deploy a hub-spoke architecture with a shared Azure Firewall in the hub VNet
- B
Configure a mesh topology by peering all VNets to each other and using Network Security Groups (NSGs) in each VNet
- C
Use Network Virtual Appliances (NVAs) in each spoke VNet to inspect traffic at the local level
- D
Rely on the default system routes and pass all traffic through an on-premises firewall only
Show answer and explanation
Correct answer: A
Explanation
The hub-spoke model with a centralized Azure Firewall in the hub is a common best practice for achieving comprehensive security and simplified management in Azure. This approach is documented in Microsoft’s reference architectures for cloud networking and security (docs.microsoft.com/azure/architecture/networking). It provides a single point of maintenance for security policies, advanced threat analytics, and streamlined configuration of routing, saving both costs and administrative effort compared to alternative designs.
- A. Correct.
Deploying a single Azure Firewall in a hub VNet and peering spoke VNets to the hub is the recommended design when you need centralized management and advanced threat protection. This approach simplifies administration because you do not have to configure a firewall in each spoke VNet; the hub firewall can be configured once to manage all outbound, inbound, and east-west traffic.
- B. Incorrect.
A mesh topology with NSGs in each VNet can quickly become complex to manage, especially as the number of VNets grows. NSGs alone do not provide the same level of advanced inspection and threat protection as Azure Firewall or other deep packet inspection tools.
- C. Incorrect.
Placing NVAs in each spoke VNet increases administrative and cost overhead. You would need to deploy and maintain multiple appliances, and any policy updates would require changes in multiple locations, rather than a single point of control.
- D. Incorrect.
Relying solely on an on-premises firewall for traffic inspection within Azure usually leads to inefficient routing, higher latency, and possible bottlenecks. It also complicates management since traffic between different VNets must traverse on-premises, defeating the purpose of a cloud-based, scalable network architecture.