AZ-500 Refer to the Exhibit Practice Questions

Explanation: Disabling 'Virtual network gateway route propagation' prevents routes from the ExpressRoute gateway from being automatically added to the subnet's route table. However, the UDR with 0.0.0.0/0 only covers internet-bound traffic. Traffic destined to on-premises networks uses the specific prefix learned from ExpressRoute (e.g., 10.0.0.0/8). Even with propagation disabled, the route table does not have a route for that specific on-premises prefix. The 0.0.0.0/0 route is less specific, so traffic matching the on-premises prefix will not use it. To force on-premises traffic through the firewall, you must add an explicit UDR for the on-premises address prefix with next hop as the Azure Firewall. The Azure Firewall's location and route table association are not the issue here.

Explanation: Azure Firewall is a fully stateful firewall as a service that can inspect and filter traffic between virtual networks. It supports network and application rules, and can be deployed in a hub VNet to route inter-spoke traffic through it. NSGs on peering connections are not stateful for traffic across peering and cannot inspect application-layer content. Application Gateway with WAF is for web traffic only and requires a specific listener. DDoS Protection only mitigates volumetric attacks, not application-level filtering.

Explanation: For a user-defined route table to affect traffic from a subnet, it must be explicitly associated with that subnet. Simply creating the route table with the desired routes is insufficient; association is required. In many cases, administrators create the route table but forget to associate it with the subnet, causing the subnet to continue using system routes (which allow direct internet access). Option A is the most likely reason. Option B is incorrect because Azure Firewall does not require DNAT rules for outbound traffic. Option C (gateway transit) is for VPN gateway scenarios, not for Azure Firewall outbound routing. Option D is false because user-defined routes take precedence over system routes.

Explanation: Azure Firewall is a managed, cloud-based network security service that provides stateful inspection of traffic. By deploying Azure Firewall in the hub VNet and configuring user-defined routes (UDRs) on spoke subnets to route inter-spoke traffic through the firewall, you can inspect all traffic. Network Virtual Appliances (NVAs) are third-party solutions, not Azure-native. VPN gateways only handle encrypted connections to on-premises or other clouds, not traffic inspection between spokes. Load balancers distribute traffic but do not inspect or filter.

Explanation: When VNet peering is configured to use the hub's VPN gateway, the spoke VNet learns more specific routes for on-premises prefixes via BGP. These BGP routes have a smaller prefix than 0.0.0.0/0, so they take precedence over the UDR, causing traffic to bypass the firewall.