How to Allow Only updates.contoso.com Through Azure Firewall?

SC-500 By islever Editorial Last updated

Implement security for Azure network services

Short answer

B Use an Azure Firewall application rule to allow only the FQDN updates.contoso.com and deny all other outbound traffic.

Question

You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1.
All the traffic from the virtual machines is routed through FW1.
You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic.
What should you use?
  1. an inbound NAT rule
  2. an application rule Correct Answer
  3. an outbound NAT rule
  4. a network rule

Key Takeaways

The question tests whether you can distinguish Azure Firewall application rules from network and NAT rules when the requirement is to allow a specific URL or FQDN; the trap is choosing a network rule because the traffic is outbound.

Azure Firewall application rules provide Layer 7 FQDN filtering for HTTP/HTTPS traffic, which is exactly what is needed to allow only updates.contoso.com while blocking all other outbound traffic. This page confirms that an application rule, not a network or NAT rule, is the correct control for the scenario.

Common mistake: A common wrong answer is a network rule, because learners associate outbound traffic with Layer 3/Layer 4 filtering. A network rule can match IP addresses, ports, and protocols, but URL or FQDN allowlisting for HTTP/HTTPS requires an Azure Firewall application rule.

Expert Analysis

Why the Answer Is Correct

Azure Firewall application rules operate at Layer 7 and support FQDN filtering for HTTP and HTTPS traffic, which matches the requirement to allow only the URL updates.contoso.com. Because all virtual machine traffic is routed through FW1, an application rule collection can allow that specific destination FQDN while the firewall's default deny behavior blocks every other outbound connection. The rule can be scoped to the virtual network address space so that all 100 virtual machines are covered without creating individual rules. This directly satisfies the stated goal of permitting only updates.contoso.com and blocking all other outbound traffic.

Why the Other Options Are Wrong

An inbound NAT rule publishes or redirects inbound connections to a backend resource; it does not filter outbound URL access. An outbound NAT rule performs source network address translation and cannot inspect or allow a specific URL. A network rule works at Layer 3/Layer 4 and matches IP addresses, ports, and protocols, so it cannot natively enforce an HTTP/HTTPS URL allowlist such as updates.contoso.com. Although Azure Firewall has limited FQDN support in network rules for non-HTTP/S protocols, the scenario is explicitly about a URL, making an application rule the designed and correct control.

Community Comment Notes

Jokke_GoGo captured the core distinction by noting “Application rules to filter on: FQDN” for HTTP/HTTPS traffic, which aligns with choosing option B. The comment reinforces that FQDN-based URL filtering belongs to the application rule path rather than the network rule path. No opposing rationale appears in the available comments, and the vote data does not override the technical requirement for Layer 7 URL filtering.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an Azure Firewall question mentions a URL, FQDN, or HTTP/HTTPS filtering, look immediately for an application rule. Reserve network rules for IP address, port, and protocol filtering, and treat NAT rules as address translation rather than outbound content control.

Frequently Asked Questions

Why is a network rule wrong for allowing updates.contoso.com?

Network rules filter by IP address, port, and protocol, so they cannot enforce an HTTP/HTTPS URL allowlist. Azure Firewall application rules are the correct control for FQDN-based filtering.

Does an application rule alone block all other outbound traffic?

Yes, when no other allow rule matches, Azure Firewall's default deny behavior blocks the remaining outbound traffic. The application rule permits only updates.contoso.com.

More SC-500 FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. scruzer 👍 1 Answered B
    Application rules filter outbound HTTP/HTTPS traffic by FQDN, so you can allow updates.contoso.com specifically. Azure Firewall denies by default, so everything else is blocked once that rule is in place. The other options don’t fit: D. Network rule: filters by IP, port, and protocol (Layer 3/4). FQDN filtering there relies on DNS proxy resolution, so it isn’t the right tool for allowing one URL. A. Inbound NAT rule: this is DNAT for inbound traffic, not outbound filtering. C. Outbound NAT rule: this is a Load Balancer concept and doesn’t apply to Azure Firewall URL filtering.
  2. Jokke_GoGo 👍 1 Answered B
    Application rules to filter on: FQDN (Fully Qualified Domain Name) URLs HTTP/HTTPS-traffic
  3. mniyas 👍 1
    D is also possible. A network rule source any vm and destination can be fqdn.
  4. Borman 👍 1
    No. Network Rules only filter by IP address, port, and protocol, not URLs.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Is Get Agent Unavailable for an Intune Security Copilot Agent?

S-grade

How Should App1 Access Azure Files Without Storage Account Keys?

S-grade

Can VM Security Group Membership Grant Storage Access?

S-grade

Can Agent ID Developer PIM Settings Be Shortened to Two Days?

S-grade

Practice All SC-500 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SC-500 Practice Test →

← Back to SC-500 Study Guide