AZ-500 Question 101
Single answerYou are designing a solution for an organization that manages multiple Azure Firewalls deployed across different subscriptions and regions. They want to enforce consistent inbound and outbound traffic filtering rules for all firewalls using a single, centrally managed configuration. Which approach should you recommend?
- A
Use Azure Firewall Manager to create a Firewall Policy and associate the same policy with each Azure Firewall instance.
- B
Configure individual application rules and network rules directly on each Azure Firewall in every subscription.
- C
Create custom NSG rules for each virtual machine and link them to Azure Firewall subnets in each subscription.
- D
Rely on Azure Default Routes to propagate firewall rules automatically across all subscriptions.
Show answer and explanation
Correct answer: A
Explanation
Azure Firewall Manager provides a centralized way to configure and manage Azure Firewall instances by creating a Firewall Policy. This approach simplifies administration across different subscriptions and regions, ensuring that all firewalls share the same set of rules. For more details, consult Microsoft’s Azure Firewall Manager documentation: https://learn.microsoft.com/azure/firewall-manager/overview.
- A. Correct.
Correct. Azure Firewall Manager allows you to create a standardized Firewall Policy that can be shared across multiple Azure Firewalls in different subscriptions and regions. This ensures consistency and centralizes administration.
- B. Incorrect.
Incorrect. Managing application and network rules directly on each Azure Firewall separately can create inconsistent configurations and makes ongoing maintenance challenging. Azure Firewall Manager with Firewall Policy is designed to avoid this siloed approach.
- C. Incorrect.
Incorrect. Network Security Groups (NSGs) can provide additional filtering at the network interface or subnet level, but they do not replace the centralized policy management capabilities of Azure Firewall Manager and Firewall Policies.
- D. Incorrect.
Incorrect. Azure Default Routes automatically handle basic routing but do not distribute firewall rules. You must explicitly configure a Firewall Policy in Azure Firewall Manager to ensure consistent rule enforcement across multiple deployments.