AZ-305 Question 239
Single answerYour company hosts multiple workloads in a hub-spoke architecture across several VNets. Management requires a unified security solution that applies consistent inbound and outbound filtering across all spokes. The solution should also allow advanced threat intelligence filtering and reduce manual overhead when new subnets or resources are deployed. Which approach best meets these requirements?
- A
Configure Network Security Groups (NSGs) on each subnet in every spoke.
- B
Deploy an Azure Application Gateway with Web Application Firewall (WAF) in each spoke.
- C
Implement Azure Firewall in the hub network and manage policies with Azure Firewall Manager.
- D
Use a third-party Network Virtual Appliance (NVA) in each spoke for unified rule management.
Show answer and explanation
Correct answer: C
Explanation
Using Azure Firewall in the hub network and managing policies via Azure Firewall Manager is considered a best practice for organizations with a hub-spoke design. It delivers centralized rule management, threat intelligence filtering, and streamlined policy enforcement across all spokes. Refer to Azure Firewall documentation (https://learn.microsoft.com/azure/firewall/) for further guidance on configuration in hub-spoke environments.
- A. Incorrect.
Option 1 (NSGs on each subnet): While NSGs provide basic control over inbound and outbound traffic, managing them separately in each subnet can become complex, especially when you add or modify multiple subnets frequently. They also do not offer advanced threat intelligence filtering.
- B. Incorrect.
Option 2 (Application Gateway with WAF): This is primarily a Layer-7 load-balancing and web application protection service. It does not provide a centralized firewall solution for both inbound and outbound traffic across multiple VNets and is less suitable for non-HTTP/S traffic.
- C. Correct.
Option 3 (Azure Firewall with Azure Firewall Manager): Azure Firewall provides a stateful, centralized firewall solution across VNets. Combining it with Azure Firewall Manager allows you to manage policies at scale, apply consistent rules to all spokes, and enable features like threat intelligence filtering with minimal overhead.
- D. Incorrect.
Option 4 (Third-party NVA in each spoke): Deploying and managing a separate NVA in each spoke can be operationally complex, introduce additional costs, and may not scale as easily. It also lacks the built-in integration and policy management capabilities provided by Azure Firewall and Firewall Manager.