AZ-700 Question 283
Single answerYour company hosts sensitive financial applications in a hub-spoke architecture on Azure. You need a stateful firewall that supports both outbound TLS inspection and an Intrusion Detection and Prevention System (IDPS) to meet strict compliance requirements. Which Azure Firewall SKU should you choose?
- A
Azure Firewall Basic
- B
Azure Firewall Standard
- C
Azure Firewall Premium
- D
Azure Firewall Standard with Web Application Firewall (WAF)
Show answer and explanation
Correct answer: C
Explanation
Azure Firewall Premium is the appropriate SKU when advanced security features such as TLS inspection and IDPS are required. Azure Firewall Basic and Standard SKUs do not include these capabilities. Incorporating a Web Application Firewall alongside Azure Firewall Standard addresses application threats for specific HTTP/HTTPS workloads but does not provide comprehensive system-wide outbound TLS inspection and IDPS. For more details, refer to Microsoft� documentation on choosing the correct Azure Firewall SKU: https://learn.microsoft.com/azure/firewall/choose-firewall-sku.
- A. Incorrect.
Azure Firewall Basic provides stateful firewall capabilities at a lower cost but lacks TLS inspection and advanced security features such as IDPS. It� designed for smaller or less complex environments and cannot fulfill the advanced compliance demands in this scenario.
- B. Incorrect.
Azure Firewall Standard does not include TLS inspection or IDPS. While it offers essential layer 3�7 traffic filtering, it cannot meet the requirement for deploying a firewall that inspects encrypted traffic and provides intrusion detection and prevention.
- C. Correct.
Azure Firewall Premium supports both TLS inspection and IDPS, making it the only SKU that meets the scenario� strict compliance needs. It includes all the capabilities of the Standard SKU plus these additional threat protection features.
- D. Incorrect.
Azure Firewall Standard with WAF (on Application Gateway) is not a direct equivalent to Azure Firewall Premium. While WAF protects web applications from specific threats (e.g., OWASP top 10), it does not replace a firewall� ability to inspect all outbound TLS traffic or provide a system-wide IDPS.