AZ-700 Question 216
Single answerYour company is launching a business-critical application in Azure that must meet regulatory requirements for secure data transmission and threat detection. The solution needs SSL/TLS inspection, network-level intrusion detection, and prevention (IDPS). You want a single Azure Firewall tier that offers these capabilities natively without additional third-party integrations. Which tier should you choose?
- A
Azure Firewall Standard
- B
Azure Firewall Premium
- C
Azure Firewall (Standard) with Network Security Group (NSG) integration
- D
Deploy Azure Firewall Standard alongside Azure Web Application Firewall (WAF)
Show answer and explanation
Correct answer: B
Explanation
Only Azure Firewall Premium includes built-in TLS inspection and IDPS. Azure Firewall Standard provides layer 3�4 filtering but does not include advanced threat detection features such as SSL/TLS traffic inspection or network-based intrusion detection/prevention. NSGs and WAF focus on other layers of security (for example, NSGs for network rules and WAF for application layer protection), so they cannot fulfill the specific need for network-level IDPS with TLS inspection on their own. For more information, refer to the Microsoft Azure Firewall Premium documentation at https://learn.microsoft.com/azure/firewall/premium.
- A. Incorrect.
Azure Firewall Standard does not support TLS/SSL inspection or built-in IDPS functionality. It provides basic network traffic filtering and threat intelligence, but does not offer the advanced threat protection features required.
- B. Correct.
Azure Firewall Premium supports TLS inspection, IDPS, and advanced threat protection, making it the correct choice for this scenario.
- C. Incorrect.
Although adding NSGs can control inbound or outbound traffic at a subnet or NIC level, they do not provide SSL/TLS inspection or IDPS features. Combining NSGs with Azure Firewall Standard would still lack the advanced capabilities needed.
- D. Incorrect.
While Azure WAF (part of Application Gateway) can protect web applications at Layer 7, it doesn't replace network-level IDPS. Also, Azure Firewall Standard alone does not handle TLS inspection, so pairing it with WAF does not meet all the requirements in a single solution.