Which Azure networking service acts as a cloud-native firewall inspecting and filtering traffic flowing through your hub VNet, including spoke-to-spoke traffic?
Show answer and explanation
Answer: B
Azure Firewall is a managed, stateful firewall deployed into a virtual network — classically the hub of a hub-and-spoke topology — where it centrally enforces NAT, network, and application rule collections across north-south and east-west flows, including traffic between spokes. It adds threat-intelligence filtering and integrates with Azure Firewall Policy for management. Putting Azure Firewall in the hub is the standard centralized cloud-native firewall pattern.
Why the other options are wrong
- A. NSGs filter traffic at subnet and network-interface level and lack the centralized stateful inspection that a hub firewall provides; they complement Azure Firewall rather than replace it.
- C. Application Gateway is a regional Layer 7 load balancer — with optional WAF on its front — that routes web requests to backends, not a VNet-level firewall.
- D. Front Door is a global entry point and content accelerator for web traffic with its own WAF; it does not inspect flows inside a VNet.