Directing Azure VNet Traffic Through Firewall
Short answer
A Create and associate route tables to direct internet traffic through the firewall.
Question
You deploy an Azure Firewall named FW1 to VNet1.
You need to ensure that FW1 can analyze and filter all the internet traffic to and from VNet1. The solution must minimize costs.
What should you do?
Key Takeaways
The core concept is Next-Hop Type inspection: ensuring traffic hits the firewall before leaving the VNet. The common trap is confusing standard routing with more expensive or complex services like Route Server.
This question tests how to route traffic from an Azure Virtual Network through a centralized Azure Firewall. The correct solution involves using User Defined Routes (UDRs) via route tables.
Common mistake: Learners often choose Azure Route Server because it automates route propagation, but this adds unnecessary cost and complexity when static routes suffice for basic internet filtering.
Expert Analysis
Why the Answer Is Correct
To ensure all internet traffic passes through Azure Firewall FW1, you must modify the default next-hop behavior of the subnets in VNet1. By creating a route table with a User Defined Route (UDR) for destination address prefix 0.0.0.0/0 (internet) and setting the next hop type to Virtual Appliance (pointing to the Firewall's private IP), you force traffic to traverse the firewall. Associating this route table with the relevant subnets achieves the goal while minimizing costs, as UDRs are free.
Why the Other Options Are Wrong
Configuring network peerings (B) connects VNETs together but does not inherently force egress traffic through a firewall unless specific routing is also applied. Creating service endpoints (C) allows VMs to access Azure services privately but does not handle general internet traffic filtering. Implementing Azure Route Server (D) provides dynamic route exchange via BGP, which is powerful but incurs additional costs and complexity compared to simple static UDRs, violating the 'minimize costs' constraint.
Community Comment Notes
Community consensus strongly supports Option A. As user blh_ noted, "Correct. You should create and associate route tables to direct internet traffic through the firewall." This confirms that UDRs are the standard, cost-effective method for this scenario.
Exam Strategy
Always look for the 'minimize costs' constraint. If a feature can be achieved with native, free capabilities like UDRs, do not jump to managed services like Route Server or ExpressRoute unless explicitly required by architecture.
Frequently Asked Questions
Why not use Azure Route Server?
What is the next hop type for a firewall?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
blh_ 👍 1 Answered ACorrect. You should create and associate route tables to direct internet traffic through the firewall.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →