Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataHard
A global enterprise is designing its multi-region Azure architecture to host critical web applications. The security architect needs to ensure robust network segmentation, centralized traffic inspection, and advanced threat protection for all outbound and inbound traffic, including URL filtering and IDPS (Intrusion Detection and Prevention System) capabilities. This solution must operate at the network layer and apply across multiple virtual networks and subscriptions. Which Azure service should be deployed?
- AAzure Front Door
- BNetwork Security Groups (NSG)
- CAzure Application Gateway
- DAzure Firewall Premium
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Firewall Premium
Azure Firewall Premium provides advanced network threat protection capabilities, including IDPS, TLS inspection, and URL filtering, for both inbound and outbound traffic across multiple virtual networks and subscriptions, operating at the network layer for centralized security.
Why the other options are wrong
- A. Azure Front Door provides global load balancing and WAF capabilities for web applications at the edge, but it's not a centralized network firewall for all traffic types across VNETs.
- B. NSGs provide basic Layer 4/5 traffic filtering and do not offer advanced threat protection like IDPS or URL filtering.
- C. Azure Application Gateway operates at Layer 7 (application layer) and provides WAF capabilities, but not network-level IDPS or centralized firewalling across VNETs for all traffic types.
Azure Firewall Premium
A cloud-native, intelligent network firewall security service that provides best-of-breed threat protection for all your Azure workloads, including advanced features like IDPS, TLS inspection, and URL filtering.
- Centralized network firewall for Azure.
- Advanced threat protection (IDPS, URL filtering, TLS inspection).
- Scalable across multiple VNETs and subscriptions.
- Operates at network layer (Layer 3/4 and Layer 7 for specific features).
Memory trick: Firewall Premium is the ultimate security guard for your entire Azure network.