An administrator is preparing to deploy an Azure Firewall to control traffic for a virtual… — Microsoft Azure Administrator (AZ-104)

An administrator is preparing to deploy an Azure Firewall to control traffic for a virtual network named `VNet-01`. The virtual network has an address space of $10.10.0.0/16$ and contains a subnet named `Subnet-01` with an address prefix of $10.10.1.0/24$ .

You need to configure the virtual network to support the Azure Firewall deployment, and ensure that all outbound traffic from `Subnet-01` to the internet is routed through the firewall.

Which configuration must be implemented?

Create a subnet named `AzureFirewallSubnet` with an address prefix of at least $/26$ , and associate a route table with `Subnet-01` that has a route to $0.0.0.0/0$ with a next hop type of Virtual appliance pointing to the firewall's private IP address.Answer
B
Create a subnet named `AzureFirewallSubnet` with an address prefix of at least $/26$ , and associate a route table with `Subnet-01` that has a route to $0.0.0.0/0$ with a next hop type of Virtual network gateway pointing to the firewall's private IP address.
C
Create a subnet named `FirewallSubnet` with an address prefix of at least $/28$ , and associate a route table with `Subnet-01` that has a route to $0.0.0.0/0$ with a next hop type of Virtual appliance pointing to the firewall's private IP address.
D
Create a subnet named `AzureFirewallSubnet` with an address prefix of at least $/26$ , and associate a Network Security Group (NSG) with `Subnet-01` containing a custom outbound rule that denies all traffic to $0.0.0.0/0$ except when the destination is the firewall's private IP address.

Answer

Create a subnet named `AzureFirewallSubnet` with an address prefix of at least

/26

, and associate a route table with `Subnet-01` that has a route to

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the firewall's private IP address.

To route outbound subnet traffic through Azure Firewall, a subnet named `AzureFirewallSubnet` with a prefix of at least

/26

must exist, and a route table with a default route of

0.0.0.0/0

pointing to the firewall's private IP using the Virtual appliance next hop type must be associated with the source subnet.

Step-by-Step Solution

Identify the subnet requirements for Azure Firewall.

Create a subnet named exactly `AzureFirewallSubnet` with a prefix size of at least

/26

Azure Firewall requires a dedicated subnet with this specific name and minimum prefix size to deploy and scale successfully.

Determine the routing mechanism to redirect traffic from `Subnet-01` through the firewall.

Associate a custom route table with `Subnet-01` that overrides default routing.

By default, traffic to the internet goes directly. A User-Defined Route is needed to force this traffic through the firewall.

Define the route parameters in the route table.

Add a route for

0.0.0.0/0

with a next hop type of Virtual appliance and the next hop address set to the firewall's private IP.

The Virtual appliance next hop type directs traffic to the private IP of the firewall instance, which then performs network filtering.

Key Concept

Azure Firewall deployment requires a dedicated `AzureFirewallSubnet` of at least

/26

and a User-Defined Route (UDR) pointing to its private IP with the Virtual appliance next hop type to route subnet traffic through it.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic