AZ-700 Question 284
Single answerA healthcare organization must comply with strict regulations that require TLS inspection on outbound traffic to identify potential data leaks. They also need advanced intrusion detection and prevention capabilities for all network traffic. Which Azure Firewall SKU is the most appropriate choice?
- A
Azure Firewall Standard
- B
Azure Firewall Premium
- C
Azure Firewall Basic
- D
Web Application Firewall (WAF) with Azure Front Door only
Show answer and explanation
Correct answer: B
Explanation
Azure Firewall Premium is specifically designed to handle scenarios requiring both TLS inspection and advanced intrusion detection and prevention (IDPS). According to Microsoft� documentation, Azure Firewall Standard does not offer these capabilities, and Azure Firewall Basic targets smaller use cases without advanced features like full TLS inspection. While a Web Application Firewall (WAF) secures web traffic at the application layer, it does not provide comprehensive inspection across all traffic types that a full firewall with TLS inspection can deliver. Therefore, Azure Firewall Premium is the correct choice for this scenario.
- A. Incorrect.
Azure Firewall Standard does not include TLS inspection or an advanced intrusion detection and prevention system (IDPS). It provides Layer 3 to Layer 7 filtering, but lacks the capabilities the scenario specifically requires.
- B. Correct.
Azure Firewall Premium supports TLS inspection and includes an advanced IDPS, making it suitable for scenarios where organizations must inspect encrypted traffic and fulfill strict regulatory requirements.
- C. Incorrect.
Azure Firewall Basic is designed for smaller-scale deployments and does not offer the TLS inspection or the advanced IDPS needed for demanding compliance requirements.
- D. Incorrect.
Web Application Firewall (WAF) with Azure Front Door focuses on Layer 7 web application protection, but does not replace a full firewall solution for all network traffic nor does it provide comprehensive TLS inspection of non-HTTP/S traffic.