Which VNets Can Host Azure Firewall AF1 in RG1

Configure secure access to virtual networks Configure and manage virtual networks in Azure

Answer Correct answer: C — AF1 must be deployed to VNET1, because the Azure Firewall and its target virtual network must both reside in RG1 in West US.

You have an Azure subscription that contains the virtual networks shown in the following table. exhibit You need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region. To which virtual networks can you deploy AF1?

VNET1, VNET2, VNET3, and VNET4
VNET1 and VNET2 only
VNET1 only Correct Answer
VNET1, VNET2, and VNET4 only
VNET1 and VNET4 only

Community Insight

The question is testing the Azure Firewall resource group placement rule, and the trap is picking every West US virtual network while ignoring that the firewall and its VNet must share a resource group.

This AZ-104 question tests the placement rules for an Azure Firewall deployment: the firewall, its target virtual network, and its public IP address must all reside in the same resource group and subscription. Because AF1 must be created in RG1 in West US, only the virtual network that also lives in RG1 can host it, which makes VNET1 the sole valid target.

Option E (VNET1 and VNET4) is the most common wrong choice, because learners focus only on the West US region match and overlook the requirement that the firewall and the VNet be deployed into the same resource group, RG1.

Community Discussion (72 comments)

dbrv 👍 1 Selected: C

https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-azure-firewall-resource-group-restrictions The Azure Firewall and virtual network must be in the same resource group. + Azure Firewall and underlying VNet have to be in the same Azure Region.

BenjaminDover 👍 1 Selected: E

Azure Firewall and underlying VNet have to be in the same Azure Region. There is no further restriction of being in the same Resource Group.

amazonalex 👍 2 Selected: E

regarding the article referenced in this discussion where it says that AF and VNET must be in the same RG, it reffers to legacy deployment model using the old configuration parameters, which required: Creating the firewall Creating the VNet Creating the public IP All in the same resource group All in the same region This was a limitation of the old Azure Firewall deployment API, which has since been replaced. Today, Azure Firewall uses the modern ARM model, where: A firewall can reference a VNet in any resource group, as long as it’s in the same region. Azure Firewall Manager and Firewall Policy also support cross‑RG deployments.

👍 1 Selected: C

READ "Ashfaque" statement.

6c2ada9 👍 1

Correct answer is E. VNET1 and VNET4 because they are in the same region as an Firewall

ALABEN 👍 3 Selected: C

The correct answer is C. VNET1 only — but not simply because the question mentions “deploy to RG1.” According to Microsoft’s Azure “The Azure Firewall and the virtual network must be in the same resource group.” REF : https://learn.microsoft.com/en-us/azure/firewall/firewall-faq?utm_source=chatgpt.com#are-there-any-azure-firewall-resource-group-restrictions

117975e 👍 1 Selected: C

VNet1 only. Azure Firewall operates in a single VNET. Microsoft says: For failure-resistant and fault-tolerant workloads, consider instances of Azure Firewall and Azure Virtual Network as regional resources. https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-firewall

MasterMans 👍 1 Selected: E

Vnet 1 and Vnet 4 are in "West US" region same as FW1

MasterMans 👍 1 Selected: C

deploy an Azure firewall named AF1 to RG1 in the West US

70ec7c1 👍 2 Selected: E

AF1 is deployed inRG1 in the West US Region. Given this setup, the question asks on which VNnet "can" AF1 be deployed. The only restriction a firewall has is that the VNet is protects must be in the same region. There is no restriction on the RG in which the firewall is associated with.

t79homasdw 👍 1 Selected: C

I agree the correct answer should be C even though VNET4 is in West US. According to this article the Azure Firewall and Virtual Network must be in the same resource group, but the Public IP can be in a different resource group. Are there any Azure firewall resource group restrictions? Yes: The Azure Firewall and virtual network must be in the same resource group. The public IP address can be in a different resource group. All resources (Azure firewall, virtual network, public IP) must be in the same subscription. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

pdossantos 👍 2 Selected: C

"Are there any firewall resource group restrictions? Yes. - The firewall and VNet must be in the same resource group. - The public IP address can be in any resource group. - The firewall, VNet, and the public IP address all must be in the same subscription." https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

WALL47 👍 5 Selected: C

The firewall and VNet must be in the same resource group. The public IP address can be in any resource group. The firewall, VNet, and the public IP address all must be in the same subscription. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions Answer = C

1d07c8e 👍 1 Selected: C

The firewall AF1 needs to be in the West US Region and in RG1. Thus the only correct answer is C. VNET1 only.

Donny_575 👍 3 Selected: C

The firewall and VNet must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

2d153f5 👍 1 Selected: B

95d0718 👍 1

Guys, read the question carefully. The answer is VNET1 & VNET4 (Answer E). Asked Gemini and tested it in my Lab, both say it's VNET1 and VNET4 - the Ressource Group does not matter in this case, it is the Region, where you deploy the Firewall.

jamesf 👍 1 Selected: C

The firewall and VNet must be in the same resource group. - The public IP address can be in any resource group. - The firewall, VNet, and the public IP address all must be in the same subscription. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq

itismadu 👍 5 Selected: C

Are there any firewall resource group restrictions? Yes. The firewall and VNet must be in the same resource group. The public IP address can be in any resource group. The firewall, VNet, and the public IP address all must be in the same subscription. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq

arnabsenx 👍 1

Even though VNET4 is in RG2, you can still deploy the F/w in VNET4 and make it a part of RG1. The question tests your knowledge on being in a resource group but having a different parent resource group. The answer should be E

moadabdou 👍 4 Selected: C

An Azure Firewall can protect a VNet in the same resource group, but it cannot directly protect a VNet in a different resource group. This is because an Azure Firewall is deployed in a VNet and filters traffic entering and exiting that VNet. It cannot interact with resources in other resource groups. If you need to protect a VNet in a different resource group, you can use one of the following workarounds: VNet peering Azure Virtual WAN VPN

moadabdou 👍 7 Selected: C

Tested in lab an Azure Firewall in a resource group (RG1) cannot protect a VNet in another resource group (RG2) even if both are in the same region.

Amir1909 👍 1

C is correct

rnd3131 👍 1

details details details

Arthur_zw 👍 1

Google Bard No, the Azure Firewall itself cannot belong to a different resource group than the resource group it protects. Azure Firewall requires tight integration with the resources it secures, including virtual networks and subnets. This integration isn't possible if the firewall resides in a separate resource group. Azure Firewall needs to be deployed in the same resource group as the resources it protects for several reasons: Policy enforcement: Azure Firewall applies its network security policies to resources within the same resource group. Placing it in a different group weakens its ability to effectively secure those resources. Resource association: Certain features of Azure Firewall, like IP Groups and Application Rules, require direct association with resources within the same resource group. Management and access control: Managing and controlling access to Azure Firewall is easier when it's within the same resource group as the resources it protects.

RandomNickname 👍 2 Selected: C

C: seems most relevant here as per comments here and the links provided confirming restrictions implementing Azure Firewall https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

Rwj 👍 2

VNET 1 Only Yes. The firewall, VNet, and the public IP address all must be in the same resource group.

SIAMIANJI 👍 2 Selected: C

C is correct.

RDIO 👍 3 Selected: C

https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions:~:text=Yes.%20The%20firewall%2C%20VNet%2C%20and%20the%20public%20IP%20address%20all%20must%20be%20in%20the%20same%20resource%20group.

madao322 👍 5 Selected: C

Firewall must be in the same RG with other needed resources. MS allows you to allocate resources in different RG/location/VNet but many of them just dont work. Additionally, moving resources will also casuse undesible system error as well. TBH, that is not understandable

mmarkiew 👍 4

Also just confirmed in Lab. I couldn't deploy the firewall to a different resource group than the VNET. Got the following error: "Azure Firewall cannot be used with a from a different resource group." The error message in Azure Portal is also a bit off - I assume it should read "...with a VNET from...".

AK4U_111 👍 2

Microsoft's words: "Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group." Source: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

CyberKelev 👍 1 Selected: B

Same region and resource group as af1

NIOBruno 👍 2 Selected: C

C: Is correct

herodes 👍 2 Selected: C

Its states you need to deploy to RG1 and West US, based on this there is only one solution and its VNET1

djgodzilla 👍 1

there's a FAQ that answers the question: Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq

RougePotatoe 👍 5

Here's a funny thing. The Faqs page I've been posting is incorrect. I was able to create a firewall with the public IP address in another RG but in the same region. The firewall must be in the same region and RG as the vNet. The firewall does not need to be in the same RG as the public ip address. The firewall does need to be in the same region as the public ip address.

Sanaz90 👍 2

I've learnt it like this: fw and vnet should be in same rg and same sub of pip

r3nenge 👍 34 Selected: C

Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq

AK4U_111 👍 5

THANK YOU!

chikorita 👍 1

Mlantonis resurfaced as Muffay god bless both

RougePotatoe 👍 1

That's very strange claim considering the question explicitly stated: " You need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region." I also disagree that RG is of no consequence. If you wanted to deploy a firewall for vNet1 you can only deploy it to RG1. I was not able to deploy a firewall for vNet1 when I configured the FW to be in RG2 even though it was in the same region. The public IP address apparently could be in another RG since I was able to deploy it with the public IP in a different RG.

lkjsatlwjwwge 👍 2

You'd normallly be right -RG are irrelevant in most cases. This is the only one I've found where actually there is a restriction that constrains your freedom to choose the RG.

lkjsatlwjwwge 👍 3 Selected: C

Muffay's reasoning is flawless, but there's a gotcha pointed out by Alexander K.

Kirucha 👍 3 Selected: C

LauLauLauw 👍 3 Selected: C

Answer is C. The FW needs to be in the same resourcegroup as the VNET as stated here: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

alexanderkartavtsev 👍 3

C. VNET1 only "The firewall, VNet, and the public IP address all must be in the same resource group." - https://learn.microsoft.com/en-us/azure/firewall/firewall-faq

RougePotatoe 👍 1

You could've clicked the link icon and gave a more specific link... https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

Mo22 👍 3 Selected: C

To deploy an Azure firewall named AF1 to RG1 in the West US Azure region, you can only deploy it to VNET1. This is because Azure Firewall is a network-level firewall, and it can be deployed only to a virtual network and it can protect the resources connected to that virtual network, You can not deploy Azure firewall to multiple virtual network.

Hongzu13 👍 1

This is a stupid question. Obviously, I you have to deploy the Vnets in the desired region, which in this case is US West.

Iszy 👍 2 Selected: E

"To which Vnets"? I'll say the ones in the same region

Irism 👍 1 Selected: E

VNET1 & VNET 4 are both in WEST US, so E is the Answer

stormtraining 👍 3

omg...

WeepingMaplte 👍 3

The key point is deploying the firewall within RG1, not just the regions where the VNets reside. The question is asking to deploy in RG1. You cannot just go any where and take a d at other places even if you can.

Ashfaque_9x 👍 67 Selected: C

C. VNET1 only No idea why people are saying option E as the question clearly states that "You need to deploy an Azure firewall named AF1 to RG1 in the West US", so RG1 in the West US region means the correct answer is C(VNET1).

Joestart 👍 1

The question only requires deploying the firewall to RG1. it does not mean that the virtual network must also be in RG1.

6c2ada9 👍 1

Provided answer is wrong. The correct answer is E. Doesn’t matter on which resource group FireWall will be located. The region for Firewall should be same.

garmatey 👍 3

But it says which virtual networks can you deploy AF1....

kilobaik 👍 11

You right "Are there any firewall resource group restrictions? Yes. The firewall, VNet, and the public IP address all must be in the same resource group." https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

biscaldis 👍 3

That's correct. This is the only case in which the resource group must be the same https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

DeBoer 👍 1

Nope, E ;-) It's E. The key here is the location of the VNETs (not the RGs). The AF needs to be in the same region the VNET is in. The region of the RG is no consequence tbh. Neither is the RG itself. RGs are just logical groupings of resources - but have very little impact on what you can do with the resources themselves.

lkjsatlwjwwge 👍 4

Answer's right, reasoning's wrong. You could deploy the fw to RG in West US to VNET4 as well, since in general the RG you choose is anecdotic. Except for the point Alexander K makes. The real reason C's the answer is this restriction that fw, VNet and public IP need to belong to the same RG.

fahrulnizam 👍 1

yes.. question clearly mention ''need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region"

pramodk78 👍 2

The question also says "To which virtual networks can you deploy AF1? " Correct answer = E

rpalanivel83 👍 1

Yes. First check is Resource group which is RG1, then second is Region which is West US

Irism 👍 7

This makes no sense, you need to read better. Vnet1 and Vnet4 are both in WEST US region

wpestan 👍 1 Selected: E

same region

vitodobra 👍 1 Selected: E

Rectifico mi comentario anterior. Respuesta E.

vitodobra 👍 3 Selected: C

El texto de la pregunta especifica que se debe crear el firewall en el grupo de recursos RG1 por lo que solo podría ser la respuesta C.

khaled_razouk 👍 5 Selected: E

E. VNET1 and VNET4 only You can deploy an Azure firewall named AF1 to the virtual networks VNET1 and VNET4. These are the only virtual networks that are in the same Azure region as the resource group (RG1) where the firewall is being deployed. AF1 cannot be deployed to VNET2 and VNET3, because they are located in a different Azure region (Central US). An Azure firewall must be deployed to the same Azure region as the virtual networks it will protect.

Muffay 👍 41 Selected: E

Should be E - Vnet 1 and Vnet 4. As all resources, the resource group is just a logical grouping and the real limitations do come from the region. An Azure Firewall can be used with peered networks, but as the question does not mention peering the firewall cannot be applied to networks in another region. "You can deploy Azure Firewall on any virtual network, but customers typically deploy it on a central virtual network and peer other virtual networks to it in a hub-and-spoke model. You can then set the default route from the peered virtual networks to point to this central firewall virtual network. Global VNet peering is supported, but it isn't recommended because of potential performance and latency issues across regions. For best performance, deploy one firewall per region." I also just tried it out, I cannot connect an Azure Firewall to a VNET which is in another region.

RougePotatoe 👍 25

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Azure Firewall must be deployed into the same resource group as the virtual network it protects, and the public IP address used by the firewall must also live in that resource group, as documented in the Azure Firewall FAQ's "Are there any firewall resource group restrictions?" entry. The question explicitly states that AF1 is being deployed to RG1 in the West US region, so only the VNet that is listed as belonging to RG1 (VNET1) can receive the firewall. As r3nenge quoted from the FAQ, "the firewall, VNet, and the public IP address all must be in the same resource group," which narrows the deployment to VNET1 alone. moadabdou confirmed this behavior empirically, reporting that an Azure Firewall in RG1 cannot protect a VNet in another resource group even when both are in the same region.

Why the Other Options Are Wrong

Option E is tempting because VNET4 is also in West US, but region alone does not satisfy the constraint — VNET4 sits in a different resource group, so AF1 cannot be allocated to it while remaining in RG1. Options A and D fail for the same reason and additionally pull in VNets that may not even be in West US, violating both the resource-group and region requirements. Option B is wrong because it includes VNET2, which the exhibit places outside RG1, so deploying AF1 to RG1 would not cover it. Region is necessary but not sufficient; the resource group match is the deciding factor here.

Community Comment Notes

Ashfaque_9x argued "the question clearly states that 'You need to deploy an Azure firewall named AF1 to RG1 in the West US'" and concluded VNET1 only, which matches the FAQ rule. Muffay countered that only region matters, claiming "the resource group is just a logical grouping and the real limitations do come from the region," but that misreads the firewall-specific FAQ restriction. Irism similarly pushed back with "Vnet1 and Vnet4 are both in WEST US region," missing that VNET4 is not in RG1. Comments from WALL47 and itismadu both pasted the official FAQ wording confirming the firewall, VNet, and public IP must share a resource group.

Official Reference

https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#are-there-any-firewall-resource-group-restrictions

Exam Strategy

On AZ-104 placement questions, build a quick constraint checklist from every noun in the prompt — resource group, region, subscription — and eliminate options that satisfy only some of them. Memorize the Azure Firewall FAQ line about the firewall, VNet, and public IP sharing a resource group, since region-only reasoning is the classic distractor.

Frequently Asked Questions

Why can't AF1 be deployed to VNET4 if it is also in West US?

Because VNET4 lives in a different resource group. The Azure Firewall FAQ requires the firewall, its VNet, and its public IP to be in the same resource group, and AF1 must be in RG1.

Does moving AF1's VNet to another resource group break the firewall?

Yes. Azure Firewall must stay in the same resource group as its VNet, so separating them can cause the deployment to fail or behave unexpectedly.

More AZ-104 FAQ →

Related Analysis

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide