Directing Azure VNet Traffic Through Firewall
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains multiple subnets and virtual machines. You deploy an Azure Firewall named FW1 to VNet1. You need to ensure that FW1 can analyze and filter all the internet traffic to and from VNet1. The solution must minimize costs. What should you do?
Community Insight
The core concept is Next-Hop Type inspection: ensuring traffic hits the firewall before leaving the VNet. The common trap is confusing standard routing with more expensive or complex services like Route Server.
This question tests how to route traffic from an Azure Virtual Network through a centralized Azure Firewall. The correct solution involves using User Defined Routes (UDRs) via route tables.
Learners often choose Azure Route Server because it automates route propagation, but this adds unnecessary cost and complexity when static routes suffice for basic internet filtering.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To ensure all internet traffic passes through Azure Firewall FW1, you must modify the default next-hop behavior of the subnets in VNet1. By creating a route table with a User Defined Route (UDR) for destination address prefix0.0.0.0/0 (internet) and setting the next hop type to Virtual Appliance (pointing to the Firewall's private IP), you force traffic to traverse the firewall. Associating this route table with the relevant subnets achieves the goal while minimizing costs, as UDRs are free.Why the Other Options Are Wrong
Configuring network peerings (B) connects VNETs together but does not inherently force egress traffic through a firewall unless specific routing is also applied. Creating service endpoints (C) allows VMs to access Azure services privately but does not handle general internet traffic filtering. Implementing Azure Route Server (D) provides dynamic route exchange via BGP, which is powerful but incurs additional costs and complexity compared to simple static UDRs, violating the 'minimize costs' constraint.Community Comment Notes
Community consensus strongly supports Option A. As user blh_ noted, "Correct. You should create and associate route tables to direct internet traffic through the firewall." This confirms that UDRs are the standard, cost-effective method for this scenario.Official Reference
Exam Strategy
Always look for the 'minimize costs' constraint. If a feature can be achieved with native, free capabilities like UDRs, do not jump to managed services like Route Server or ExpressRoute unless explicitly required by architecture.
Frequently Asked Questions
Why not use Azure Route Server?
Route Server uses BGP and incurs hourly costs. UDRs are free and sufficient for static internet routing.
What is the next hop type for a firewall?
When creating the UDR, the next hop type must be set to 'Virtual Appliance' pointing to the firewall's private IP.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →