AZ-500 Question 100
Single answerYou are the security engineer for a company that has deployed multiple Azure Firewalls across different regions and subscriptions. Currently, each firewall is managed independently, which leads to inconsistent policy configurations and increased administrative overhead. You want to unify the management of these firewalls so that any changes to rules or policies will automatically propagate to all firewalls. Which solution should you implement to achieve this goal?
- A
Manually replicate firewall rules on each Azure Firewall to ensure they match
- B
Create a Firewall Policy in Azure Firewall Manager and associate it with all Azure Firewalls
- C
Use Network Security Groups (NSGs) in each firewall’s subnet to standardize configurations
- D
Leverage user-defined routes (UDRs) to direct traffic through a single Azure Firewall
Show answer and explanation
Correct answer: B
Explanation
Azure Firewall Manager allows you to define a single Firewall Policy and apply it to multiple Azure Firewalls. By using Firewall Manager and the associated Firewall Policy, you automate policy updates, ensuring every Azure Firewall consistently uses the same configurations. This approach reduces management complexity and prevents discrepancies between individual firewall rule sets. For more details, refer to the official Microsoft documentation on Azure Firewall Manager (https://learn.microsoft.com/azure/firewall-manager).
- A. Incorrect.
Replicating rules manually on each Azure Firewall is error-prone and doesn't provide centralized management or automatic policy updates.
- B. Correct.
Creating a Firewall Policy in Azure Firewall Manager and associating it with each Azure Firewall is the recommended approach for centralized and consistent rule configuration across multiple firewalls.
- C. Incorrect.
Network Security Groups primarily control inbound and outbound traffic at the subnet or network interface level, but they do not consolidate or synchronize Azure Firewall policies across multiple regions.
- D. Incorrect.
User-defined routes control network traffic at a routing level but do not offer a unified policy framework to manage Azure Firewall rules across different deployments.