AZ-700 Question 294
Select 2You manage a global environment connected via a single Azure Virtual WAN, where multiple branch offices and VNets are connected to a hub in East US. The company needs to inspect and filter all inbound and outbound traffic using Azure Firewall without manually managing network peering or complex routing. Which two actions should you take to ensure all spokeVNet traffic is routed through a secure hub with Azure Firewall?
- A
Enable Azure Firewall in the Virtual WAN hub by upgrading it to a Secure Virtual Hub and attach a Firewall Policy to the hub.
- B
Create a standalone Azure Firewall in a separate VNet and peer that VNet to the Virtual WAN hub.
- C
Configure custom routing in the hub� default route table to direct spoke traffic to the Azure Firewall instance in the Secure Virtual Hub.
- D
Enable forced tunneling to your on-premises datacenter so the firewall filters traffic before forwarding it back to Azure.
Show answer and explanation
Correct answers: A, C
Explanation
By upgrading the Azure Virtual WAN hub to a Secure Virtual Hub, you can deploy Azure Firewall natively in the hub, simplifying traffic inspection and threat protection. You also need to configure the route tables to ensure spoke traffic is directed to the firewall. This conforms to Microsoft� best practices for implementing Azure Firewall in a Secure Virtual Hub (see Microsoft Docs: Configure a Secured Virtual Hub in Azure Virtual WAN).
- A. Correct.
Correct. To deploy Azure Firewall within the Virtual WAN hub, you must upgrade the hub to a Secure Virtual Hub, then attach or configure a Firewall Policy to manage rules and behavior.
- B. Incorrect.
Incorrect. A separate Azure Firewall in a VNet peered with the hub adds complexity and does not leverage the integrated capabilities of a Secure Virtual Hub. This approach contradicts the goal of simplifying management and routing.
- C. Correct.
Correct. Custom routing ensures that all relevant traffic from your spokes is directed to the firewall in the hub, providing unified inspection, protection, and logging for inbound and outbound flows.
- D. Incorrect.
Incorrect. Forced tunneling to on-premises does not inherently inspect traffic in the Azure Firewall unless your on-premises routing is configured accordingly, and it complicates the traffic path. The question specifically requires inspection in the Azure Firewall inside the Virtual WAN hub.