AZ-305 Design infrastructure solutions Practice Question
A company has multiple Azure VNets deployed in a hub-spoke topology. They want to inspect all outbound internet traffic from spoke VMs using a central firewall and ensure that traffic from all VNets goes through the firewall before reaching the internet. They also need to log all outbound connections. Which architecture should they implement?
⚠ Common exam trap
Watch out — candidates often confuse Azure Firewall with Azure Application Gateway, mistakenly thinking WAF can inspect outbound traffic, or they assume deploying NVAs per spoke is acceptable for central inspection, missing the requirement for a single central firewall in the hub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop
Azure Firewall is a managed, stateful firewall-as-a-service that can centrally inspect and log outbound internet traffic. By deploying Azure Firewall in the hub VNet and configuring a default route (0.0.0.0/0) in each spoke's route table with the Azure Firewall private IP as the next hop, all outbound traffic from spoke VMs is forced through the firewall before reaching the internet. This satisfies both the inspection and logging requirements, as Azure Firewall provides built-in outbound connection logging via diagnostic settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs
Why it's wrong here
Placing NVAs in each spoke replicates the security stack per workload rather than centralizing it. Each spoke then needs its own HA pair or scale set, its own user-defined route table pointing 0.0.0.0/0 to the NVA's internal IP, and the operational burden of patching, licensing, and failover for every appliance. This also scatters outbound public IPs across spokes, defeating the requirement for a single, centrally controlled egress and inspection point.
- ✓
Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop
Why this is correct
In this design, Azure Firewall is deployed into a dedicated AzureFirewallSubnet in the hub, and each spoke's route table contains a 0.0.0.0/0 UDR with the firewall's private IP as the next hop. Because Azure Firewall performs destination NAT and source network address translation (SNAT), all spoke egress emerges from the hub with a single public IP while every connection is logged and inspectable. This creates a true central enforcement point for outbound traffic, supports policy consistency, and is the standard hub-spoke egress pattern.
- ✗
Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic
Why it's wrong here
Application Gateway with WAF is a layer-7 reverse proxy designed for inbound HTTP/S traffic directed to backend pools, not a general-purpose firewall for outbound connections from VMs. It cannot intercept arbitrary protocols, raw TCP/UDP, or non-web egress, and its WAF rule set evaluates inbound request payloads rather than outbound traffic. Therefore, placing it in the hub does nothing to force or filter spoke internet egress; it would only front-end specific applications.
- ✗
Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs
Why it's wrong here
Deploying Azure Firewall separately in every spoke distributes the security boundary and creates per-spoke egress, eliminating the centralized hub inspection point and the single public outbound IP the requirement asks for. Azure Monitor can aggregate logs, but logging aggregation is not an enforcement mechanism and does not create a common routing path or consistent firewall policy. Management, upgrade, cost, and rule synchronization overhead are multiplied across every spoke.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.