Examkin

Question

Difficulty: MediumConfigure Azure Firewall

Your company has an Azure virtual network named `VNet1` that contains a workload subnet named `Subnet1`. You need to deploy Azure Firewall to control outbound internet traffic from `Subnet1`. Which two configuration changes must you perform? (Choose two.)

  1. Create a subnet named AzureFirewallSubnet with an address prefix of /26 or larger.Answer
  2. Create a route table associated with Subnet1 that routes 0.0.0.0/0 to the private IP address of the firewall using a next hop type of Virtual appliance.Answer
  3. C
    Create a subnet named AzureFirewallSubnet with an address prefix of /28.
  4. D
    Create a route table associated with Subnet1 that routes 0.0.0.0/0 to the public IP address of the firewall using a next hop type of Virtual Network Gateway.

Answer

To configure Azure Firewall, you must create a dedicated subnet named AzureFirewallSubnet with an address prefix of /26 or larger, and configure a user-defined route in a route table associated with the workload subnet that directs 0.0.0.0/0 traffic to the private IP address of the firewall using the Virtual appliance next hop type.
Deploying Azure Firewall requires a dedicated subnet named AzureFirewallSubnet with a minimum size of /26. To direct outbound traffic through the firewall, a user-defined route for 0.0.0.0/0 must be configured with a next hop type of Virtual appliance pointing to the private IP address of the firewall.

Step-by-Step Solution

1
Determine the subnet requirements for Azure Firewall
Identify that Azure Firewall requires a dedicated subnet named AzureFirewallSubnet with a minimum prefix of /26.
Azure Firewall cannot be deployed into standard workload subnets and needs a sufficiently large dedicated subnet to scale.
2
Determine the routing requirements to direct traffic to the firewall
Identify that a route table with a default route of 0.0.0.0/0 pointing to the firewall's private IP address with a next hop of Virtual appliance is required.
Outbound traffic from workloads must be explicitly redirected to the private IP of the firewall; setting the wrong next hop type or using the public IP will break routing.
3
Associate the route table to the workload subnet
The route table is linked to Subnet1.
This applies the routing rules to the workload subnet's outbound traffic.

Key Concept

Azure Firewall deployment requires a dedicated subnet named AzureFirewallSubnet with at least a /26 prefix. Routing traffic through it requires a User-Defined Route (UDR) pointing to the firewall's private IP address with the Virtual appliance next hop type.
Rate this question

Topics

Configure Azure Firewall

More questions from this topic