AZ-700 Question 285
Select 2You are designing an Azure Firewall deployment for an organization that wants to protect multiple spoke virtual networks with a single firewall in a central hub VNet. The organization needs to filter both inbound connections from the internet and outbound traffic from the spoke networks, while maintaining a centrally managed security policy. Which of the following design considerations are correct for this scenario? (Choose two.)
- A
Place the Azure Firewall in a dedicated subnet named 'AzureFirewallSubnet' in the hub VNet
- B
Configure multiple public IP addresses on Azure Firewall if you need to handle more inbound NAT rules than a single IP supports
- C
User-defined routes (UDRs) in the spoke VNets are unnecessary, as Azure Firewall automatically inspects all outbound traffic
- D
Azure Firewall must be deployed in each spoke VNet to filter traffic effectively
Show answer and explanation
Correct answers: A, B
Explanation
When designing an Azure Firewall deployment in a hub-and-spoke architecture, you must place the firewall in a specially named AzureFirewallSubnet and configure user-defined routes in each spoke to direct outbound traffic to the firewall for inspection. Additionally, Azure Firewall supports multiple public IP addresses for NAT rules. For more information, see: https://learn.microsoft.com/azure/firewall/overview
- A. Correct.
Option 1 is correct. Azure Firewall requires a dedicated subnet named 'AzureFirewallSubnet' in the virtual network where it is deployed. This ensures the firewall has the necessary permissions and address space for operation.
- B. Correct.
Option 2 is correct. You can assign multiple public IP addresses to Azure Firewall, which is useful for scenarios requiring many inbound NAT rules or specific IP-based application requirements.
- C. Incorrect.
Option 3 is incorrect. Azure Firewall does not automatically inspect outbound traffic from spoke VNets unless you configure user-defined routes (UDRs) on those spoke subnets to direct traffic to the firewall as the next hop.
- D. Incorrect.
Option 4 is incorrect. A single Azure Firewall in a hub VNet can protect multiple spoke VNets using a hub-and-spoke topology. You do not have to deploy a separate firewall in each spoke.