AZ-700 Question 288
Select 3You have a single Azure Virtual Network (VNet) named 'CorpVNet' with a subnet called 'ProdSubnet' hosting several virtual machines. You need to deploy an Azure Firewall to control outbound internet traffic from these VMs and allow inbound traffic from the internet only on a specific port for a custom application. Which three steps must you take to meet these requirements?
- A
Create a dedicated subnet named 'AzureFirewallSubnet' in 'CorpVNet' and deploy Azure Firewall there.
- B
Associate a route table with 'ProdSubnet' to route 0.0.0.0/0 traffic to the Azure Firewall's private IP address.
- C
Use an application rule collection to allow inbound traffic from the internet on the custom port to the VMs in 'ProdSubnet'.
- D
Configure a DNAT rule in Azure Firewall to forward inbound connections on the custom port from its public IP to the VMs in 'ProdSubnet'.
- E
Enable forced tunneling by setting the next hop for 0.0.0.0/0 to an on-premises gateway in the route table associated with 'ProdSubnet'.
Show answer and explanation
Correct answers: A, B, D
Explanation
In an Azure Firewall deployment, the firewall must reside in a subnet named 'AzureFirewallSubnet' and have a route table forcing outbound traffic from other subnets through it. For inbound traffic from the internet on a specific port, you use a DNAT rule. Application rules apply to outbound HTTP/HTTPS-based scenarios, not inbound connections. Refer to the official Azure Firewall documentation for additional details: https://learn.microsoft.com/azure/firewall.
- A. Correct.
Option 1 is correct. Azure Firewall must be deployed in a dedicated subnet named 'AzureFirewallSubnet' within the same VNet. This is a requirement for the firewall to function properly.
- B. Correct.
Option 2 is correct. To force outbound internet traffic from the VMs through the firewall, you must associate a route table with 'ProdSubnet' and specify the firewall's private IP as next hop for 0.0.0.0/0.
- C. Incorrect.
Option 3 is incorrect. Application rule collections in Azure Firewall are used for outbound access to FQDNs and are not applicable for allowing inbound connections on custom ports from the internet; inbound traffic requires a DNAT rule.
- D. Correct.
Option 4 is correct. DNAT rules are necessary to translate inbound connections from the firewall's public IP on specified ports to the internal addresses of the VMs in 'ProdSubnet'.
- E. Incorrect.
Option 5 is incorrect. Forced tunneling via on-premises gateways is not required merely to inspect internet-bound traffic. This would redirect traffic on-premises rather than through Azure Firewall if you had a site-to-site setup, which is not the scenario here.