AZ-700 Question 282
Single answerYour organization has deployed Azure Firewall to secure traffic for a set of virtual machines in a hub-spoke architecture. They must restrict outbound traffic to specific fully qualified domain names (FQDNs), route all Internet-bound traffic through on-premises for advanced inspection (i.e., forced tunneling), and store detailed logs for compliance in a central Azure Monitor Log Analytics workspace. Which approach using Azure Firewall best addresses these requirements?
- A
Configure only network rules for IP-based filtering and store logs locally on the VM. Avoid custom routes to on-premises.
- B
Enable application rules with FQDN-based filtering, configure forced tunneling through user-defined routes (UDRs), and send firewall logs to Log Analytics.
- C
Implement DNAT rules for inbound flow, rely on default system routes for outbound, and disable diagnostics logging.
- D
Use threat intelligence mode set to 'Alert Only' to handle outbound traffic, configure FQDN tags for all domains, and export logs to Azure Storage.
Show answer and explanation
Correct answer: B
Explanation
Azure Firewall offers distinct features for different security needs. Network rules work at Layer 4 (IP-based), while application rules work at Layer 7 (FQDN-based). To control outbound traffic by domain, you must use application rules. For forced tunneling, you can configure user-defined routes (UDRs) to send traffic to an on-premises next hop. Finally, storing diagnostics logs in Azure Monitor Log Analytics ensures centralized visibility, essential for compliance and auditing. For more details, refer to Microsoft docs on Azure Firewall features and configuration (https://learn.microsoft.com/azure/firewall).
- A. Incorrect.
Incorrect. Network rules alone cannot filter outbound traffic by domain name; they operate at Layer 4 using IP addresses and ports only. Also, storing logs locally on the VM is neither recommended nor meets the centralized compliance requirement.
- B. Correct.
Correct. Application rules support FQDN-based filtering at Layer 7, enabling the firewall to restrict outbound traffic to specific domain names. Forced tunneling can be achieved through user-defined routes to on-premises. Sending logs to Log Analytics meets the centralized logging and compliance requirement.
- C. Incorrect.
Incorrect. DNAT rules apply primarily to inbound traffic translation. Relying on default system routes does not implement forced tunneling, and disabling diagnostic logging contradicts the compliance requirement for detailed insights into traffic flow.
- D. Incorrect.
Incorrect. Threat intelligence set to 'Alert Only' provides awareness of known malicious IPs and domains but does not enforce domain-level restrictions. Additionally, generic FQDN tags cover common Microsoft services only, not arbitrary domains, and exporting logs to Azure Storage alone is usually not sufficient for centralized monitoring or advanced analytics.