AZ-700 Question 148
Select 2You manage a global organization with multiple on-premises branch locations. You have configured an Azure Virtual WAN and must ensure that all branch traffic is inspected by Azure Firewall in a secured virtual hub before reaching workloads deployed in multiple Azure regions. Which two actions should you take to achieve this design?
- A
Bind your Virtual WAN hub to Azure Firewall Manager and configure the hub as a secured virtual hub.
- B
Create a custom route table in the Virtual WAN hub with a default route (0.0.0.0/0) pointing to Azure Firewall, then associate this custom route table with your site-to-site connections.
- C
Deploy a separate instance of Azure Firewall in each spoke virtual network and configure user-defined routes to direct traffic to these discrete firewalls.
- D
Enable BGP route propagation on the default route table to route branch traffic directly to spoke subnets without additional routing.
Show answer and explanation
Correct answers: A, B
Explanation
To design a secured Azure Virtual WAN architecture, you typically link your hub to Azure Firewall Manager and configure a secured virtual hub. You then define a custom hub route table that sends all (0.0.0.0/0) or specific traffic flows to Azure Firewall. Associating this route table with site-to-site connections ensures traffic is routed to the firewall for inspection before continuing to workloads. For more information, refer to Azure Virtual WAN and Firewall Manager documentation.
- A. Correct.
Correct. Binding your Virtual WAN hub to Azure Firewall Manager and configuring it as a secured virtual hub centralizes security services. This setup allows Azure Firewall to inspect all traffic passing through the hub.
- B. Correct.
Correct. By creating a custom route table with a default route directed to Azure Firewall and associating it with your site-to-site connections, you ensure that on-premises traffic routes through the firewall for inspection before reaching other Azure resources.
- C. Incorrect.
Incorrect. You do not need separate Azure Firewall instances in each spoke. A single secured virtual hub with Azure Firewall provides centralized inspection and management, reducing cost and complexity.
- D. Incorrect.
Incorrect. Simply relying on BGP route propagation to the default route table would bypass the firewall and send traffic directly to the spoke subnets, preventing centralized traffic inspection.