Microsoft Certified: Azure Security Engineer AssociateSecure data and applicationsMedium
A large enterprise uses Azure Kubernetes Service (AKS) to host mission-critical applications. The security team mandates that all outbound traffic from the AKS cluster to external endpoints (e.g., external APIs, SaaS services) must be centrally inspected and filtered by a stateful firewall. This firewall should also integrate with threat intelligence feeds. Which Azure networking service should be deployed for this purpose?
- AAzure Application Gateway with WAF.
- BAzure Network Security Groups (NSGs).
- CKubernetes Network Policies.
- DAzure Firewall.
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Firewall.
Azure Firewall is a stateful, managed network security service that provides centralized network protection for all your Azure Virtual Network resources. It fully supports filtering outbound traffic, integrates with threat intelligence, and is designed for enterprise-grade security, making it ideal for inspecting and filtering all outbound AKS traffic.
Why the other options are wrong
- A. Azure Application Gateway with WAF is primarily an L7 load balancer and web application firewall that protects *inbound* web traffic, not outbound traffic from AKS to external services.
- B. NSGs are stateless, provide basic L4 filtering, and do not offer centralized inspection, threat intelligence integration, or stateful filtering capabilities required.
- C. Kubernetes Network Policies control inter-pod communication *within* the AKS cluster, not outbound traffic to external endpoints.
Azure Firewall for AKS Outbound
Deploying Azure Firewall in conjunction with Azure Kubernetes Service (AKS) to centrally inspect, filter, and secure all outbound network traffic originating from the AKS cluster.
- Stateful firewall for VNet traffic.
- Centralized outbound traffic inspection.
- Integrates with threat intelligence.
Memory trick: Azure Firewall is the 'bouncer' at the AKS exit, checking every packet leaving.