AZ-700 Question 292
Select 2You manage an environment with multiple secured virtual hubs across different Azure regions. You want to implement a solution that enforces a standard set of firewall rules while allowing each region to add additional rules as needed. You decide to use Azure Firewall Manager and plan to create a parent firewall policy containing global rule collections, then create child policies for region-specific rule sets. Which two of the following statements about implementing these Azure Firewall Manager policies are correct?
- A
You can only associate one Firewall Manager policy with all hubs, making it impossible to add region-specific rules separately.
- B
To enforce common rules globally, you create a parent firewall policy and associate it with multiple secured virtual hubs, so each hub inherits the base policy.
- C
Child policies allow you to extend or override rule collections inherited from the parent policy, enabling region-specific configurations while retaining globally enforced rules.
- D
DNS settings that are defined in the parent policy are locked and cannot be overridden in the child policies.
Show answer and explanation
Correct answers: B, C
Explanation
Azure Firewall Manager allows you to create a base (parent) firewall policy to centrally manage and apply consistent security settings across multiple secured virtual hubs. Child policies inherit the parent policy� rules but can also define additional or overriding rules for specific regional needs. For more details, refer to Microsoft� documentation on Azure Firewall Manager policies: https://learn.microsoft.com/azure/firewall-manager/policies-overview
- A. Incorrect.
Incorrect. Azure Firewall Manager supports hierarchical policies. You are not restricted to only one policy for all hubs. By creating child policies, you can add region-specific rules on top of the global baseline.
- B. Correct.
Correct. This is the fundamental use case of Azure Firewall Manager. You create a parent (base) policy that provides a common rule set and associate it with your secured virtual hubs. Each hub then inherits these baseline rules, ensuring consistency.
- C. Correct.
Correct. One of the key benefits of hierarchical firewall policies is that child policies can override or supplement the parent policy� rule collections. This setup allows each region to apply custom rules without losing the centrally enforced baseline.
- D. Incorrect.
Incorrect. DNS settings, like other policy elements, can be configured in the child policy to override or complement the parent policy� settings. You are not locked into a single DNS configuration across all hubs.