AZ-500 Question 102
Select 2Your organization has multiple Azure subscriptions, each hosting its own Azure Firewall instance. You need to enforce a centralized, consistent set of network and application rules across all these firewalls to simplify management. You decide to use Azure Firewall Manager and firewall policies to achieve this. Which two actions should you perform to meet these requirements?
- A
Create a single Azure Firewall Policy in the same region as each Azure Firewall to unify rule management.
- B
Associate each Azure Firewall instance with the newly created Azure Firewall Policy to ensure consistent rule enforcement across all subscriptions.
- C
Deploy a separate Azure Firewall Manager instance for each subscription to isolate configuration changes from other subscriptions.
- D
Configure a global IP-based security policy by enabling forced tunneling for all traffic in the Azure Firewall Manager.
- E
Use Azure Firewall Manager to create secured virtual hubs and apply the Azure Firewall Policy across multiple hubs.
Show answer and explanation
Correct answers: B, E
Explanation
To centrally manage multiple Azure Firewall instances and ensure consistent rule sets, you should create and maintain a single Azure Firewall Policy, then associate each firewall with that policy through Azure Firewall Manager. Additionally, deploying secured virtual hubs in Azure Firewall Manager (if using Azure Virtual WAN) can further streamline policy enforcement and reduce management overhead. For more details, refer to Microsoft's documentation on Azure Firewall Manager and Azure Firewall Policies: https://docs.microsoft.com/azure/firewall-manager/.
- A. Incorrect.
Incorrect: While creating a firewall policy is important, you do not need to create a separate policy in each region along with each Azure Firewall. A single Azure Firewall Policy can be centrally managed and associated with multiple firewalls, regardless of their regions, simplifying rule management rather than duplicating policy efforts.
- B. Correct.
Correct: You must associate each Azure Firewall instance with the Azure Firewall Policy. This association ensures that all firewalls will enforce the same set of rules, making it easier to maintain consistent security standards across subscriptions.
- C. Incorrect.
Incorrect: Deploying a separate Azure Firewall Manager instance in each subscription goes against the goal of centralizing and simplifying management. Azure Firewall Manager is designed to orchestrate firewall policies across multiple subscriptions from one place, not to create multiple isolated managers.
- D. Incorrect.
Incorrect: Forced tunneling routes traffic from Azure to on-premises for inspection and might not be necessary for achieving a single, centralized rule set. Enabling forced tunneling by itself does not guarantee unified rule management across subscriptions and can introduce additional network complexity.
- E. Correct.
Correct: Azure Firewall Manager allows you to create secured virtual hubs (if using Virtual WAN) and apply the same Azure Firewall Policy to those hubs, enabling consistent security rules. This approach scales across multiple virtual hubs and subscriptions, providing a unified management experience.