An administrator plans to deploy Azure Firewall to secure outbound traffic from a virtual … — Microsoft Azure Administrator (AZ-104)

An administrator plans to deploy Azure Firewall to secure outbound traffic from a virtual network named VNet1. VNet1 has an address space of $10.10.0.0/16$ and contains a workload subnet named WorkloadSubnet with an address prefix of $10.10.1.0/24$ .

Which two actions should the administrator perform to deploy the firewall and route WorkloadSubnet traffic through it? (Select two.)

Create a subnet named AzureFirewallSubnet that has an address prefix of $10.10.2.0/26$ .Answer
Create a route table containing a route for $0.0.0.0/0$ with a next hop type of Virtual appliance pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.Answer
C
Create a route table containing a route for $0.0.0.0/0$ with a next hop type of Virtual Network Gateway pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.
D
Create a subnet named FirewallSubnet that has an address prefix of $10.10.2.0/28$ .

Answer

Create a subnet named AzureFirewallSubnet with an address prefix of

10.10.2.0/26

AND create a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the private IP address of the firewall, and associate the route table with WorkloadSubnet.

To successfully deploy Azure Firewall and route traffic from a workload subnet, two main components must be configured: first, a dedicated subnet named exactly AzureFirewallSubnet must be created within the virtual network, and it must have a subnet mask of

/26

or larger (such as

/26

/25

). Second, a route table with a default route (

0.0.0.0/0

) pointing to the private IP address of the firewall as a 'Virtual appliance' next hop must be created and associated with the workload subnet.

Step-by-Step Solution

Define the subnet for the Azure Firewall.

Create a subnet named AzureFirewallSubnet with a prefix size of at least

/26

(e.g.,

10.10.2.0/26

Azure Firewall requires a dedicated subnet named exactly AzureFirewallSubnet with a minimum prefix size of

/26

to accommodate the firewall instances.

Route traffic from the workload subnet to the firewall.

Create a route table with a route for

0.0.0.0/0

(all internet-bound traffic) using a next hop type of Virtual appliance and specify the private IP address of the firewall.

To force outbound internet traffic from WorkloadSubnet through the firewall, a custom route table (UDR) is required, and the next hop must be the firewall's private IP, which acts as a virtual appliance.

Associate the route table.

Associate the route table with WorkloadSubnet.

The route table only applies to subnets to which it is explicitly associated.

Key Concept

Deploying and routing traffic through Azure Firewall requires a dedicated subnet named AzureFirewallSubnet (minimum

/26

prefix) and a User-Defined Route (UDR) with the next hop type set to Virtual appliance pointing to the firewall's private IP address.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic