Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataHard
A global enterprise is designing its multi-region Azure architecture to host critical web applications and APIs. The security architect needs to ensure that all traffic entering the Azure environment from the internet is inspected for threats, filtered according to security policies, and centrally logged for auditing. This solution must also provide high availability and scalability across multiple regions. Which Azure security service should be deployed as the central ingress point for network traffic?
- ANetwork Security Groups (NSGs)
- BAzure NAT Gateway
- CAzure Firewall Premium
- DAzure Virtual Network Gateway
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Firewall Premium
Azure Firewall Premium is a cloud-native, highly scalable network security service that provides advanced threat protection capabilities, including TLS inspection, IDPS, and URL filtering. It operates centrally, can be deployed across regions, and supports centralized logging, making it ideal for securing ingress traffic at an enterprise scale.
Why the other options are wrong
- A. Network Security Groups (NSGs) provide basic Layer 4 (TCP/UDP) filtering at the subnet or NIC level and lack advanced threat intelligence, centralized management, or logging for enterprise-wide ingress security.
- B. Azure NAT Gateway provides outbound internet connectivity for VMs in a VNet but does not inspect or filter inbound traffic for threats.
- D. Azure Virtual Network Gateway is used for VPN or ExpressRoute connectivity between on-premises networks and Azure, not for securing public internet ingress to web applications.
Azure Firewall Premium
Azure Firewall Premium is a next-generation firewall with advanced threat protection capabilities such as TLS inspection, Intrusion Detection and Prevention System (IDPS), and URL filtering. It provides centralized network security across hybrid cloud environments.
- TLS inspection for encrypted traffic.
- IDPS to detect and block network attacks.
- URL filtering for controlling access to websites.
- Highly scalable and available, suitable for enterprise-wide protection.
Memory trick: Firewall Premium is the ultimate security guard for your Azure network perimeter.