AZ-305 Question 238
Single answerYour organization hosts multiple workloads in Azure that are segmented into separate subnets across multiple Azure subscriptions. You need a solution that will centrally manage both inbound and outbound traffic rules to simplify oversight and improve security. Which recommendation should you make to optimize network security for all resources?
- A
Deploy an Azure Application Gateway with Web Application Firewall in each subnet for centralized control of inbound and outbound traffic
- B
Place a single Azure Firewall in a hub virtual network and use Azure Firewall Policy for consistent rule management
- C
Configure multiple Network Security Groups (NSGs) at each virtual machine level to control inbound and outbound traffic
- D
Deploy NSGs in each subnet and manually replicate rules across all subnets to centrally manage traffic
Show answer and explanation
Correct answer: B
Explanation
Azure Firewall, when placed in a hub virtual network, can protect resources in spoke virtual networks by controlling inbound and outbound traffic centrally. Azure Firewall Policy allows the creation of a unified security policy that can be easily managed and applied across multiple environments. This approach is in line with Microsoft best practices for hub-and-spoke network architectures (refer to official Azure Firewall documentation: https://docs.microsoft.com/azure/firewall). By contrast, NSGs and WAF are suitable for more localized or layer-specific scenarios but do not provide the same centralized, scalable rule management or full traffic filtering capabilities.
- A. Incorrect.
Incorrect. While Application Gateway with WAF protects web applications at Layer 7 against common attacks, it does not provide a centralized, hub-based model for outbound traffic filtering or advanced threat intelligence filtering. It is primarily for HTTP/HTTPS traffic security.
- B. Correct.
Correct. Azure Firewall in the hub network provides a single point for managing traffic into and out of multiple spokes. Using Azure Firewall Policy allows consistent deployment and management of rules across multiple subscriptions and VNets, reducing overhead while increasing security and compliance.
- C. Incorrect.
Incorrect. Placing NSGs on each VM network interface would quickly become cumbersome to manage at scale. NSGs also lack advanced threat intelligence features and a central point of administration for inbound and outbound traffic rules across multiple subscriptions.
- D. Incorrect.
Incorrect. Replicating rules manually across NSGs in each subnet is prone to errors and inconsistent configurations, and it does not offer the centralized, policy-based approach needed for security at scale.