AZ-500 Question 60
Select 2Your company has multiple on-premises branch offices that connect to Azure VNets via an Azure Virtual WAN. You have deployed a secured virtual hub with Azure Firewall to inspect and protect traffic traveling from on-premises to Azure. You want to ensure all on-premises site-to-site traffic is routed through the Azure Firewall in the secured virtual hub. Which two actions should you take? (Choose two.)
- A
Associate the site-to-site VPN connections with the default Virtual WAN route table so that all traffic is automatically routed to the Azure Firewall as next hop.
- B
Create a custom route table in the secured virtual hub specifying the Azure Firewall as the default next hop, and associate it with the site-to-site VPN connections.
- C
Enable the Security Provider in the secured virtual hub to register Azure Firewall as the integrated security service.
- D
Deploy an additional Azure Firewall in each spoke VNet to process all traffic before it reaches the secured virtual hub.
Show answer and explanation
Correct answers: B, C
Explanation
To direct all on-premises traffic through Azure Firewall in a secured virtual hub, you must configure a custom route table and associate it with your site connections. You also need to enable the Security Provider in the secured hub to ensure Azure Firewall inspects the traffic. A single, centrally managed Azure Firewall in the hub is sufficient for multiple spokes. For more details, refer to Microsoft documentation on Secure Virtual Hub (https://learn.microsoft.com/azure/virtual-wan/secure-virtual-hub).
- A. Incorrect.
Option 1 is incorrect because merely associating site-to-site connections with the default route table does not guarantee that all traffic is routed through the Azure Firewall. You must explicitly define the next hop in a custom or modified default route table to route traffic via the firewall.
- B. Correct.
Option 2 is correct. Creating a custom route table in the secured virtual hub and assigning the default route (0.0.0.0/0) to the Azure Firewall forces on-premises traffic to pass through the firewall. Associating the site-to-site connections with this route table ensures that all branch traffic is inspected.
- C. Correct.
Option 3 is correct. Enabling the Security Provider in the secured virtual hub is required to integrate Azure Firewall for traffic inspection and policy enforcement. Without enabling the firewall as a security provider, the hub cannot automatically apply security policies to on-premises traffic.
- D. Incorrect.
Option 4 is incorrect because you do not need a separate Azure Firewall in each spoke VNet. A single Azure Firewall deployed in the secured hub can provide a central inspection point for multiple branch offices and VNets.