AZ-305 Question 222
Single answerYour company has an Azure Virtual Network that hosts multiple application and web server subnets. A new security requirement mandates that all outbound Internet traffic must be filtered through a dedicated firewall solution located in a separate 'firewall subnet.' You need to ensure that any Internet-bound traffic from the application and web subnets is routed through the firewall for inspection before reaching the Internet. Which approach should you implement to meet this requirement?
- A
Create a custom route table with a default route (0.0.0.0/0) that has the firewall’s private IP as the next hop
- B
Enable service endpoints for each subnet to automatically route traffic to the firewall subnet
- C
Configure an NSG with outbound rules to force all Internet traffic to the firewall’s IP address
- D
Use Azure Bastion in each subnet to route Internet-bound traffic to the firewall
Show answer and explanation
Correct answer: A
Explanation
To enforce that all outbound traffic passes through a firewall, you must create a custom route table (or user-defined route) applied to the relevant subnets. The default route (0.0.0.0/0) should point to the firewall’s internal IP, ensuring all outbound traffic is sent to the firewall for inspection before reaching the Internet. For more information, refer to Microsoft’s documentation on user-defined routes and forced tunneling: https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview.
- A. Correct.
This option is correct. Using a user-defined route with a default route (0.0.0.0/0) pointing to the firewall’s private IP ensures all outbound traffic is directed to the firewall for inspection before it leaves to the Internet. This is a standard method for forcing Internet-bound traffic through a specific network appliance in Azure.
- B. Incorrect.
This option is incorrect because service endpoints are primarily used to secure Azure services (e.g., Azure Storage, Azure SQL) by granting them direct private traffic paths within a virtual network. Service endpoints do not force general outbound traffic to flow through a firewall.
- C. Incorrect.
This option is incorrect because NSGs (Network Security Groups) filter and allow or deny traffic based on rules, but they do not modify routing paths. You cannot force all traffic to a specific IP using NSG rules alone.
- D. Incorrect.
This option is incorrect because Azure Bastion is used for secure RDP/SSH connections to virtual machines without exposing public IPs. It is not designed to route all outbound Internet traffic through a firewall.