AZ-700 Question 151
Select 2You are designing a Virtual WAN architecture for an enterprise with multiple branch offices across the globe. The organization requires advanced threat protection using Azure Firewall and plans to connect these branches through existing on-premises routers, ensuring secure connectivity to resources hosted in multiple Azure regions. Which of the following statements describe recommended best practices for this design? (Choose two.)
- A
Deploy a standard Virtual WAN with a secured virtual hub that integrates Azure Firewall for centralized security inspection.
- B
Use a basic Virtual WAN hub if you require Azure Firewall and advanced security services.
- C
Site-to-site VPN and ExpressRoute connections can both be used to attach branch offices to Virtual WAN hubs.
- D
Force tunnel all traffic to on-premises data centers by default to apply advanced threat protection in Azure.
Show answer and explanation
Correct answers: A, C
Explanation
In designing a Virtual WAN solution, organizations requiring advanced threat protection should deploy a Standard Virtual WAN and enable a secured virtual hub to integrate Azure Firewall. This setup provides centralized security inspection and threat protection across all connected sites. Branches can connect using site-to-site VPN or ExpressRoute, offering flexibility and global reach. For detailed guidance, refer to official Azure Virtual WAN documentation: https://learn.microsoft.com/azure/virtual-wan/virtual-wan-about.
- A. Correct.
Option 1 is correct. Deploying a standard Virtual WAN with a secured virtual hub is the recommended approach to integrate Azure Firewall and centralize security. The secured hub allows you to manage traffic inspection across all connected sites and Azure workloads.
- B. Incorrect.
Option 2 is incorrect. A basic Virtual WAN hub does not support Azure Firewall integration. Advanced security features require using a Standard Virtual WAN and enabling the secured hub.
- C. Correct.
Option 3 is correct. Azure Virtual WAN supports multiple connection types, including site-to-site VPN and ExpressRoute, for branch office connectivity. This design flexibility is a key benefit of Virtual WAN.
- D. Incorrect.
Option 4 is incorrect. While forced tunneling can be configured for specific scenarios, it is not a default or required practice for applying advanced threat protection. In a secured hub scenario, Azure Firewall can provide threat protection without routing all traffic back on-premises.