SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

Question

You have an Azure virtual network containing 100 virtual machines and an Azure Firewall instance named FW1. All traffic from the virtual machines is routed through FW1.

You need to ensure that FW1 permits access only to the URL updates.contoso.com and blocks all other outbound traffic.

What should you use?

Explanation

Azure Firewall application rules filter outbound HTTP/S traffic at Layer 7 by fully qualified domain name (FQDN), URL, or web category. An allow rule for updates.contoso.com, with no broader allow rules, permits that destination while unmatched outbound traffic remains blocked. NAT rules perform address translation, and network rules are intended for Layer 3/4 address, port, and protocol filtering.

Learn more

Azure Firewall and traffic inspection

SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

AstroTutor

Notes

Readiness

QuestionQ1

Community Discussion