AZ-700 Question 280
Select 2Your company operates workloads across multiple Azure regions. You decide to use Azure Firewall Manager to create a secured virtual hub in each region so that inbound and outbound traffic from all spokes is inspected by Azure Firewall. Which two configurations must you implement to ensure that newly added spokes in each region automatically route their traffic through the respective Azure Firewall instance for policy enforcement?
- A
Associate a Firewall Policy with each secured virtual hub in Azure Firewall Manager
- B
Create custom route tables in the Virtual WAN environment so that 0.0.0.0/0 is routed to Azure Firewall
- C
Enable BGP route distribution from your on-premises edge devices to each secured hub and rely on dynamic routing
- D
Deploy a NAT Gateway in each spoke to handle egress traffic
- E
Manually create user-defined routes in each spoke� subnet that point 0.0.0.0/0 to the Azure Firewall private IP address
Show answer and explanation
Correct answers: A, B
Explanation
To centrally manage and automatically enforce inbound/outbound traffic inspections with Azure Firewall, you combine Azure Firewall Manager with a secured virtual hub in each region. By attaching a Firewall Policy to each hub and configuring custom route tables in the Virtual WAN environment, you ensure that newly added spokes in each region route traffic through the Azure Firewall without requiring manual user-defined routes. This approach is outlined in Microsoft� Azure Firewall Manager documentation under 'Secured virtual hubs and routing configurations.'
- A. Correct.
Correct. In Azure Firewall Manager, you must attach a Firewall Policy to each secured virtual hub so that centralized rules and configurations can be applied automatically to any spoke that is connected to that hub.
- B. Correct.
Correct. To ensure that every spoke routes internet-bound traffic (0.0.0.0/0) through the secured hub, you need to configure custom route tables in the Virtual WAN environment. These route tables will redirect traffic through the Azure Firewall, enforcing inspection and filtering.
- C. Incorrect.
Incorrect. While BGP route distribution can propagate routes, by itself it doesn�t guarantee that all spoke traffic is forced through the Azure Firewall for inspection. You still need explicit routing rules (user-defined routes or custom route tables) to direct traffic to the firewall.
- D. Incorrect.
Incorrect. NAT Gateways in each spoke are not required if you already have Azure Firewall managing egress traffic. Azure Firewall provides egress NAT capabilities, making separate NAT Gateways unnecessary for the purpose of centralized inspection.
- E. Incorrect.
Incorrect. Manually creating user-defined routes in each spoke� subnets can work, but it does not scale well for newly added spokes. Azure Firewall Manager with custom route tables offers a more automated approach for ensuring new spokes are covered by the same inspection policies without manual intervention.