AZ-104 Practice Question 89: Firewall FQDN Filtering
Microsoft Azure Administrator Associate (AZ-104) · Test 9 · question 9 of 10
Virtual machines in a spoke network must reach only *.microsoft.com over HTTPS. All other outbound internet traffic must be blocked, and the rule should be written by name, not by IP address.
What should the administrator use?
Show answer and explanation
Answer:
Azure Firewall application rules filter outbound HTTP, HTTPS and other traffic by fully qualified domain name. A user-defined route sends the spoke traffic to the firewall, and a default deny handles everything else.
Option A is wrong because network security groups filter on addresses, service tags and application security groups, not on FQDNs.
Option B only groups network interfaces of your own virtual machines as sources or destinations.
Option C secures access to selected Azure services and does not filter internet destinations by name.
Reference: Azure Firewall features