A company runs three Azure Firewalls in separate virtual hubs. Each needs the same rule collections and the same threat intelligence mode, and the security team wants one place to edit them. Which resource should hold these settings?
Show answer and explanation
Answer: C
Azure Firewall Policy is a separate resource that holds rule collections, threat intelligence settings, DNS settings, and TLS inspection configuration. Several firewalls can reference one policy, so a change is made once and applies to all of them. NSGs filter subnet or NIC traffic and cannot serve as shared firewall rule sets. Network Watcher is a diagnostics service.
Why the other options are wrong
- A. NSGs attach to subnets or NICs and are not the rule store for Azure Firewall. One per hub would split the policy again instead of centralizing it.
- B. Virtual Network Manager groups virtual networks and manages connectivity and admin security rules. It does not hold Azure Firewall rule collections.
- D. Network Watcher offers diagnostic tools such as packet capture and topology views. It does not store firewall rules or threat intelligence settings.