Question
You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1.
All the traffic from the virtual machines is routed through FW1.
You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic.
What should you use?
- A. an inbound NAT rule
- B. an application rule Correct
- C. an outbound NAT rule
- D. a network rule
Explanation
Application rules filter outbound HTTP and HTTPS traffic by name, matching on the Host header or SNI, so a rule that targets updates.contoso.com allows that site. Azure Firewall denies traffic that matches no rule, so everything else is blocked without another rule. Network rules are the layer that works with IP protocols, addresses and ports rather than web names. Inbound NAT rules translate traffic coming in to the firewall, and an outbound NAT rule is not an Azure Firewall rule type.
