How to Allow Only updates.contoso.com Through Azure Firewall?
You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1. All the traffic from the virtual machines is routed through FW1. You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic. What should you use?
Community Insight
The question tests whether you can distinguish Azure Firewall application rules from network and NAT rules when the requirement is to allow a specific URL or FQDN; the trap is choosing a network rule because the traffic is outbound.
Azure Firewall application rules provide Layer 7 FQDN filtering for HTTP/HTTPS traffic, which is exactly what is needed to allow only updates.contoso.com while blocking all other outbound traffic. This page confirms that an application rule, not a network or NAT rule, is the correct control for the scenario.
A common wrong answer is a network rule, because learners associate outbound traffic with Layer 3/Layer 4 filtering. A network rule can match IP addresses, ports, and protocols, but URL or FQDN allowlisting for HTTP/HTTPS requires an Azure Firewall application rule.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Firewall application rules operate at Layer 7 and support FQDN filtering for HTTP and HTTPS traffic, which matches the requirement to allow only the URL updates.contoso.com. Because all virtual machine traffic is routed through FW1, an application rule collection can allow that specific destination FQDN while the firewall's default deny behavior blocks every other outbound connection. The rule can be scoped to the virtual network address space so that all 100 virtual machines are covered without creating individual rules. This directly satisfies the stated goal of permitting only updates.contoso.com and blocking all other outbound traffic.Why the Other Options Are Wrong
An inbound NAT rule publishes or redirects inbound connections to a backend resource; it does not filter outbound URL access. An outbound NAT rule performs source network address translation and cannot inspect or allow a specific URL. A network rule works at Layer 3/Layer 4 and matches IP addresses, ports, and protocols, so it cannot natively enforce an HTTP/HTTPS URL allowlist such as updates.contoso.com. Although Azure Firewall has limited FQDN support in network rules for non-HTTP/S protocols, the scenario is explicitly about a URL, making an application rule the designed and correct control.Community Comment Notes
Jokke_GoGo captured the core distinction by noting “Application rules to filter on: FQDN” for HTTP/HTTPS traffic, which aligns with choosing option B. The comment reinforces that FQDN-based URL filtering belongs to the application rule path rather than the network rule path. No opposing rationale appears in the available comments, and the vote data does not override the technical requirement for Layer 7 URL filtering.Official Reference
Exam Strategy
When an Azure Firewall question mentions a URL, FQDN, or HTTP/HTTPS filtering, look immediately for an application rule. Reserve network rules for IP address, port, and protocol filtering, and treat NAT rules as address translation rather than outbound content control.
Frequently Asked Questions
Why is a network rule wrong for allowing updates.contoso.com?
Network rules filter by IP address, port, and protocol, so they cannot enforce an HTTP/HTTPS URL allowlist. Azure Firewall application rules are the correct control for FQDN-based filtering.
Does an application rule alone block all other outbound traffic?
Yes, when no other allow rule matches, Azure Firewall's default deny behavior blocks the remaining outbound traffic. The application rule permits only updates.contoso.com.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →