A regulated bank wants every packet that leaves a workload subnet for the internet to pass through a central inspection point that logs flows and applies threat rules. Which configuration achieves this?
Show answer and explanation
Answer: D
A user-defined route for 0.0.0.0/0 with the Azure Firewall private IP as next hop sends internet-bound traffic through the firewall, where it is inspected and logged. The firewall typically sits in a hub network. NSGs can filter but do not centrally inspect and log all egress. Application Gateway handles inbound web traffic, and Bastion handles administrative sessions.
Why the other options are wrong
- A. NSG rules filter traffic by address, port and protocol, but they do not redirect packets through a central appliance and cannot provide threat inspection or a single egress log.
- B. Application Gateway with WAF protects inbound HTTP(S) traffic to web apps; it does not inspect arbitrary outbound internet traffic originating from workload subnets.
- C. Bastion brokers RDP and SSH into virtual machines and can record those sessions, but it does not inspect general outbound internet traffic from the subnet.