AZ-305 Design infrastructure solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  VNet peering with gateway transit

  Why it's wrong here

  VNet peering provides connectivity between virtual networks but does not route traffic through a firewall. Gateway transit allows a peered VNet to use the virtual network gateway in the hub, yet that only extends connectivity to on-premises networks; it does not redirect outbound traffic to Azure Firewall. Forcing traffic through the firewall requires UDRs that explicitly set the next hop to the firewall's private IP. Without such routes, system routes remain in effect, so peering alone cannot enforce firewall inspection.

• ✓

  User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall

  Why this is correct

  A UDR with an address prefix of 0.0.0.0/0 and a next hop type of VirtualAppliance, pointing to the Azure Firewall's private IP, overrides the system default route for all outbound traffic from associated subnets. This forces all internet-bound traffic through the firewall, ensuring stateful inspection and symmetric routing for return packets. UDRs are the core mechanism for forced tunneling and centralized egress control in a hub-and-spoke architecture, making this the correct solution.

• ✗

  Azure Route Server

  Why it's wrong here

  Azure Route Server uses BGP to dynamically exchange routes between your NVAs and Azure virtual networks, which is useful for route propagation in complex topologies. However, it does not enforce forced tunneling or mandate that outbound traffic traverse a firewall; it only communicates route information. Even with Route Server, you still need UDRs or BGP-learned routes to send traffic to the firewall, and there is no guarantee of symmetric routing or complete inspection. Therefore, Route Server alone cannot secure outbound traffic.

• ✗

  Azure Firewall Manager to enforce routing policies

  Why it's wrong here

  Azure Firewall Manager is a management and policy orchestration service that centralizes firewall policies, security rules, and network management across multiple Azure Firewall instances. It simplifies deployment and policy consistency, but it does not enforce traffic routing by itself—routing is accomplished through UDRs, which Firewall Manager may automatically generate for a secured virtual hub. Even when Firewall Manager provisions UDRs, the actual enforcement relies on those routes to direct traffic to the firewall, not on the manager's policy definitions. Thus, it is incorrect to say Firewall Manager enforces routing policies; it only helps create the underlying UDRs.

Go deeper

Related to this question