A group security office needs deny rules that every regional firewall must honor. Each region may add its own allow rules, but no regional policy may weaken the global deny list. Which firewall rule architecture meets this requirement?
Show answer and explanation
Answer: C
Azure Firewall Policy supports inheritance, so a parent policy holds the company-wide rule collections and each regional child policy inherits them. Parent rules are processed ahead of child rules, so a global deny cannot be overridden by a regional allow. Independent policies would drift apart, repeated NSGs are not inherited, and Traffic Manager works at the DNS level.
Why the other options are wrong
- A. NSGs with service tags can express deny rules per subnet, but they must be duplicated on every subnet and are not inherited. Regional teams would still edit local copies, so there is no single baseline.
- B. Independent policies can be configured identically, but nothing links them, so a change in one place does not propagate. Without inheritance, the central deny list cannot be enforced consistently.
- D. Traffic Manager profiles route DNS queries among endpoints. They do not define packet or application rules for a firewall, so they cannot enforce a deny baseline.