Which VNets Can Host Azure Firewall AF1 in RG1

AZ-104 By islever Editorial Last updated

Configure secure access to virtual networks Configure and manage virtual networks in Azure

Short answer

C AF1 must be deployed to VNET1, because the Azure Firewall and its target virtual network must both reside in RG1 in West US.

Question

You have an Azure subscription that contains the virtual networks shown in the following table.
Exhibit: Which VNets Can Host Azure Firewall AF1 in RG1
You need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region.
To which virtual networks can you deploy AF1?
  1. VNET1, VNET2, VNET3, and VNET4
  2. VNET1 and VNET2 only
  3. VNET1 only Correct Answer
  4. VNET1, VNET2, and VNET4 only
  5. VNET1 and VNET4 only

Key Takeaways

The question is testing the Azure Firewall resource group placement rule, and the trap is picking every West US virtual network while ignoring that the firewall and its VNet must share a resource group.

This AZ-104 question tests the placement rules for an Azure Firewall deployment: the firewall, its target virtual network, and its public IP address must all reside in the same resource group and subscription. Because AF1 must be created in RG1 in West US, only the virtual network that also lives in RG1 can host it, which makes VNET1 the sole valid target.

Common mistake: Option E (VNET1 and VNET4) is the most common wrong choice, because learners focus only on the West US region match and overlook the requirement that the firewall and the VNet be deployed into the same resource group, RG1.

Expert Analysis

Why the Answer Is Correct

Azure Firewall must be deployed into the same resource group as the virtual network it protects, and the public IP address used by the firewall must also live in that resource group, as documented in the Azure Firewall FAQ's "Are there any firewall resource group restrictions?" entry. The question explicitly states that AF1 is being deployed to RG1 in the West US region, so only the VNet that is listed as belonging to RG1 (VNET1) can receive the firewall. As r3nenge quoted from the FAQ, "the firewall, VNet, and the public IP address all must be in the same resource group," which narrows the deployment to VNET1 alone. moadabdou confirmed this behavior empirically, reporting that an Azure Firewall in RG1 cannot protect a VNet in another resource group even when both are in the same region.

Why the Other Options Are Wrong

Option E is tempting because VNET4 is also in West US, but region alone does not satisfy the constraint — VNET4 sits in a different resource group, so AF1 cannot be allocated to it while remaining in RG1. Options A and D fail for the same reason and additionally pull in VNets that may not even be in West US, violating both the resource-group and region requirements. Option B is wrong because it includes VNET2, which the exhibit places outside RG1, so deploying AF1 to RG1 would not cover it. Region is necessary but not sufficient; the resource group match is the deciding factor here.

Community Comment Notes

Ashfaque_9x argued "the question clearly states that 'You need to deploy an Azure firewall named AF1 to RG1 in the West US'" and concluded VNET1 only, which matches the FAQ rule. Muffay countered that only region matters, claiming "the resource group is just a logical grouping and the real limitations do come from the region," but that misreads the firewall-specific FAQ restriction. Irism similarly pushed back with "Vnet1 and Vnet4 are both in WEST US region," missing that VNET4 is not in RG1. Comments from WALL47 and itismadu both pasted the official FAQ wording confirming the firewall, VNet, and public IP must share a resource group.

Official Reference

https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

This link opens the official vendor documentation in a new tab.

Exam Strategy

On AZ-104 placement questions, build a quick constraint checklist from every noun in the prompt — resource group, region, subscription — and eliminate options that satisfy only some of them. Memorize the Azure Firewall FAQ line about the firewall, VNet, and public IP sharing a resource group, since region-only reasoning is the classic distractor.

Frequently Asked Questions

Why can't AF1 be deployed to VNET4 if it is also in West US?

Because VNET4 lives in a different resource group. The Azure Firewall FAQ requires the firewall, its VNet, and its public IP to be in the same resource group, and AF1 must be in RG1.

Does moving AF1's VNet to another resource group break the firewall?

Yes. Azure Firewall must stay in the same resource group as its VNet, so separating them can cause the deployment to fail or behave unexpectedly.

More AZ-104 FAQ →

Discussion 71 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 71

  1. Ashfaque_9x 👍 67 Answered C
    C. VNET1 only No idea why people are saying option E as the question clearly states that "You need to deploy an Azure firewall named AF1 to RG1 in the West US", so RG1 in the West US region means the correct answer is C(VNET1).
  2. Muffay 👍 41 Answered E
    Should be E - Vnet 1 and Vnet 4. As all resources, the resource group is just a logical grouping and the real limitations do come from the region. An Azure Firewall can be used with peered networks, but as the question does not mention peering the firewall cannot be applied to networks in another region. "You can deploy Azure Firewall on any virtual network, but customers typically deploy it on a central virtual network and peer other virtual networks to it in a hub-and-spoke model. You can then set the default route from the peered virtual networks to point to this central firewall virtual network. Global VNet peering is supported, but it isn't recommended because of potential performance and latency issues across regions. For best performance, deploy one firewall per region." I also just tried it out, I cannot connect an Azure Firewall to a VNET which is in another region.
  3. r3nenge 👍 34 Answered C
    Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq
  4. kilobaik 👍 11
    You right "Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group." https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions
  5. moadabdou 👍 7 Answered C
    Tested in lab an Azure Firewall in a resource group (RG1) cannot protect a VNet in another resource group (RG2) even if both are in the same region.
Show 25 more comments
  1. Irism 👍 7
    This makes no sense, you need to read better. Vnet1 and Vnet4 are both in WEST US region
  2. khaled_razouk 👍 5 Answered E
    E. VNET1 and VNET4 only You can deploy an Azure firewall named AF1 to the virtual networks VNET1 and VNET4. These are the only virtual networks that are in the same Azure region as the resource group (RG1) where the firewall is being deployed. AF1 cannot be deployed to VNET2 and VNET3, because they are located in a different Azure region (Central US). An Azure firewall must be deployed to the same Azure region as the virtual networks it will protect.
  3. RougePotatoe 👍 5
    Here's a funny thing. The Faqs page I've been posting is incorrect. I was able to create a firewall with the public IP address in another RG but in the same region. The firewall must be in the same region and RG as the vNet. The firewall does not need to be in the same RG as the public ip address. The firewall does need to be in the same region as the public ip address.
  4. WALL47 👍 5 Answered C
    The firewall and VNet must be in the same resource group. The public IP address can be in any resource group. The firewall, VNet, and the public IP address all must be in the same subscription. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions Answer = C
  5. itismadu 👍 5 Answered C
    Are there any firewall resource group restrictions? Yes. The firewall and VNet must be in the same resource group. The public IP address can be in any resource group. The firewall, VNet, and the public IP address all must be in the same subscription. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq
  6. madao322 👍 5 Answered C
    Firewall must be in the same RG with other needed resources. MS allows you to allocate resources in different RG/location/VNet but many of them just dont work. Additionally, moving resources will also casuse undesible system error as well. TBH, that is not understandable
  7. AK4U_111 👍 5
    THANK YOU!
  8. moadabdou 👍 4 Answered C
    An Azure Firewall can protect a VNet in the same resource group, but it cannot directly protect a VNet in a different resource group. This is because an Azure Firewall is deployed in a VNet and filters traffic entering and exiting that VNet. It cannot interact with resources in other resource groups. If you need to protect a VNet in a different resource group, you can use one of the following workarounds: VNet peering Azure Virtual WAN VPN
  9. mmarkiew 👍 4
    Also just confirmed in Lab. I couldn't deploy the firewall to a different resource group than the VNET. Got the following error: "Azure Firewall cannot be used with a from a different resource group." The error message in Azure Portal is also a bit off - I assume it should read "...with a VNET from...".
  10. lkjsatlwjwwge 👍 4
    Answer's right, reasoning's wrong. You could deploy the fw to RG in West US to VNET4 as well, since in general the RG you choose is anecdotic. Except for the point Alexander K makes. The real reason C's the answer is this restriction that fw, VNet and public IP need to belong to the same RG.
  11. ALABEN 👍 3 Answered C
    The correct answer is C. VNET1 only — but not simply because the question mentions “deploy to RG1.” According to Microsoft’s Azure “The Azure Firewall and the virtual network must be in the same resource group.” REF : https://learn.microsoft.com/en-us/azure/firewall/firewall-faq?utm_source=chatgpt.com#are-there-any-azure-firewall-resource-group-restrictions
  12. Mo22 👍 3 Answered C
    To deploy an Azure firewall named AF1 to RG1 in the West US Azure region, you can only deploy it to VNET1. This is because Azure Firewall is a network-level firewall, and it can be deployed only to a virtual network and it can protect the resources connected to that virtual network, You can not deploy Azure firewall to multiple virtual network.
  13. Kirucha 👍 3 Answered C
    Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions
  14. RDIO 👍 3 Answered C
    https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions:~:text=Yes.%20The%20firewall%2C%20VNet%2C%20and%20the%20public%20IP%20address%20all%20must%20be%20in%20the%20same%20resource%20group.
  15. WeepingMaplte 👍 3
    The key point is deploying the firewall within RG1, not just the regions where the VNets reside. The question is asking to deploy in RG1. You cannot just go any where and take a d at other places even if you can.
  16. LauLauLauw 👍 3 Answered C
    Answer is C. The FW needs to be in the same resourcegroup as the VNET as stated here: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions
  17. biscaldis 👍 3
    That's correct. This is the only case in which the resource group must be the same https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions
  18. Donny_575 👍 3 Answered C
    The firewall and VNet must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions
  19. alexanderkartavtsev 👍 3
    C. VNET1 only "The firewall, VNet, and the public IP address all must be in the same resource group." - https://learn.microsoft.com/en-us/azure/firewall/firewall-faq
  20. vitodobra 👍 3 Answered C
    El texto de la pregunta especifica que se debe crear el firewall en el grupo de recursos RG1 por lo que solo podría ser la respuesta C.
  21. lkjsatlwjwwge 👍 3 Answered C
    Muffay's reasoning is flawless, but there's a gotcha pointed out by Alexander K.
  22. garmatey 👍 3
    But it says which virtual networks can you deploy AF1....
  23. stormtraining 👍 3
    omg...
  24. amazonalex 👍 2 Answered E
    regarding the article referenced in this discussion where it says that AF and VNET must be in the same RG, it reffers to legacy deployment model using the old configuration parameters, which required: Creating the firewall Creating the VNet Creating the public IP All in the same resource group All in the same region This was a limitation of the old Azure Firewall deployment API, which has since been replaced. Today, Azure Firewall uses the modern ARM model, where: A firewall can reference a VNet in any resource group, as long as it’s in the same region. Azure Firewall Manager and Firewall Policy also support cross‑RG deployments.
  25. pdossantos 👍 2 Answered C
    "Are there any firewall resource group restrictions? Yes. - The firewall and VNet must be in the same resource group. - The public IP address can be in any resource group. - The firewall, VNet, and the public IP address all must be in the same subscription." https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Enable SSPR for Entra Identities

S-grade

Assigning Fabric Licenses in Entra ID Free Tenant

S-grade

Which Certificate from Vault1 for WebApp1 TLS?

S-grade

Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

S-grade

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide