AZ-700 Question 215
Single answerYour company is deploying a new line-of-business application that processes sensitive data. You need to enforce TLS inspection for outbound traffic, utilize Intrusion Detection and Prevention (IDPS), and block malicious IP addresses in real time. Which Azure Firewall tier would best meet these requirements?
- A
Azure Firewall Standard
- B
Azure Firewall Premium
- C
Azure Application Gateway WAF v2
- D
A Basic Azure Load Balancer with Network Security Groups
Show answer and explanation
Correct answer: B
Explanation
Azure Firewall Premium is designed for high-security requirements where TLS inspection and Intrusion Detection and Prevention (IDPS) capabilities are crucial. This tier allows you to decrypt outbound traffic, inspect it for malicious content, and block threats in real time, which is essential for protecting sensitive business applications. For more details, refer to the official Azure documentation on Azure Firewall Premium features (https://docs.microsoft.com/azure/firewall/premium-features).
- A. Incorrect.
Azure Firewall Standard does not support TLS inspection or IDPS. It can filter traffic based on application rules and network rules, but it cannot decrypt and inspect SSL/TLS traffic.
- B. Correct.
Azure Firewall Premium supports TLS inspection, IDPS, and advanced threat protection capabilities, making it suitable for scenarios where deep packet inspection and real-time threat detection are required.
- C. Incorrect.
Azure Application Gateway WAF v2 does provide web application firewall capabilities, but it does not replace Azure Firewall when you need deeper inspection for outbound connections, nor does it provide an IDPS feature like Azure Firewall Premium.
- D. Incorrect.
A Basic Azure Load Balancer combined with Network Security Groups does not provide TLS inspection or advanced threat intelligence features, making it insufficient for the requirements stated.