Microsoft Certified: Azure Security Engineer AssociateImplement platform protectionHard
A security engineer is configuring a highly secure Azure Virtual Network (VNet) for a government client. The client stipulates that all outbound internet access from any subnet within this VNet must be explicitly filtered and logged, and only approved FQDNs (Fully Qualified Domain Names) and service tags should be allowed. Additionally, they need Intrusion Detection and Prevention System (IDPS) capabilities for deep packet inspection. Which Azure service is designed to provide these advanced network security features?
- AAzure Load Balancer
- BAzure Application Gateway
- CAzure Network Security Groups (NSGs)
- DAzure Firewall Premium
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Firewall Premium
Azure Firewall Premium offers advanced network security capabilities including FQDN filtering, service tags, and most importantly, IDPS for deep packet inspection. This comprehensive feature set directly meets the client's stringent requirements for outbound traffic filtering, logging, and intrusion prevention.
Why the other options are wrong
- A. Azure Load Balancer distributes incoming network traffic across backend resources; it is not a security filtering service.
- B. Azure Application Gateway is a web application firewall and load balancer; it does not provide general outbound internet filtering or IDPS for non-web traffic.
- C. NSGs provide basic 5-tuple filtering (IP, port, protocol) but lack FQDN filtering, service tags for outbound, logging capabilities, or IDPS.
Azure Firewall Premium
Azure Firewall Premium is a cloud-native, intelligent network firewall security service that provides advanced threat protection for your cloud workloads.
- Includes IDPS (Intrusion Detection and Prevention System) for deep packet inspection.
- Supports TLS inspection for encrypted traffic.
- Offers FQDN (Fully Qualified Domain Name) filtering for outbound traffic.
- Integrates with Microsoft Threat Intelligence for enhanced protection.
Memory trick: For the toughest network security, 'Firewall Premium' inspects and defends with precision.