The correct choice is Azure Firewall because it is the only Azure networking service that provides full Layer 3–7 inspection with native support for FQDN filtering across subnets. Unlike a network security group, which operates at Layers 3 and 4 and cannot filter by domain names, Azure Firewall uses application rules to allow or deny traffic based on fully qualified domain names, and its threat intelligence feeds can detect malicious patterns in inter-subnet traffic when routing is properly configured. On the AZ-500 exam, this question tests your understanding of the difference between stateful packet inspection (NSGs) and application-layer inspection (Azure Firewall), often appearing as a trap where candidates mistakenly choose Azure Firewall Manager or a third-party NVA. Remember the key distinction: if the requirement mentions FQDN filtering or threat intelligence, Azure Firewall is the answer—think “FQDN = Firewall.”
AZ-500 Secure networking Practice Question
This AZ-500 practice question tests your understanding of secure networking. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: azure Firewall provides stateful firewall as a service.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has an Azure virtual network with multiple subnets hosting different tiers of an application. The security team requires inspection of all traffic between subnets for malicious patterns and the ability to allow or deny traffic based on fully qualified domain names (FQDNs). Which Azure networking service should they implement?
Why wrong: NSGs provide network layer (layer-3/4) filtering based on IP addresses, ports, and protocols, but cannot inspect application layer content or use FQDNs.
B
Azure Firewall
Azure Firewall is a stateful firewall with application (FQDN) and network rules, enabling inspection and filtering of traffic between subnets.
C
Azure Application Gateway
Why wrong: Azure Application Gateway is a layer-7 load balancer for web applications, not for filtering inter-subnet traffic.
D
Azure VPN Gateway
Why wrong: Azure VPN Gateway is used for site-to-site or VNet-to-VNet encrypted connections, not for internal traffic inspection.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Azure Firewall is a managed, cloud-based network security service that provides full Layer 3–7 inspection and can filter traffic based on FQDNs in network and application rules. It can inspect all traffic between subnets in a virtual network (via forced tunneling or routing) and supports threat intelligence-based filtering for malicious patterns, making it the correct choice for this requirement.
Key principle: Azure Firewall provides stateful firewall as a service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Azure Network Security Group (NSG)
Why it's wrong here
NSGs provide network layer (layer-3/4) filtering based on IP addresses, ports, and protocols, but cannot inspect application layer content or use FQDNs.
✓
Azure Firewall
Why this is correct
Azure Firewall is a stateful firewall with application (FQDN) and network rules, enabling inspection and filtering of traffic between subnets.
Related concept
Azure Firewall provides stateful firewall as a service.
✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a layer-7 load balancer for web applications, not for filtering inter-subnet traffic.
✗
Azure VPN Gateway
Why it's wrong here
Azure VPNGateway is used for site-to-site or VNet-to-VNet encrypted connections, not for internal traffic inspection.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse NSGs with Azure Firewall, assuming NSGs can filter based on FQDNs or inspect traffic for malicious patterns, but NSGs lack Layer 7 inspection and FQDN support, which are exclusive to Azure Firewall in this context.
Detailed technical explanation
How to think about this question
Azure Firewall uses a combination of network rules (based on IP, port, and protocol) and application rules (based on FQDNs) to control traffic. For inter-subnet inspection, you must configure user-defined routes (UDRs) to force all traffic through the firewall's private IP; without this, traffic between subnets bypasses the firewall entirely. The firewall integrates with Azure Monitor and Threat Intelligence feeds to detect malicious patterns, and it supports TLS inspection for encrypted traffic when configured.
KKey Concepts to Remember
Azure Firewall provides stateful firewall as a service.
It supports both network (Layer 3/4) and application (Layer 7) rules.
FQDN filtering is a key application-layer capability of Azure Firewall.
Azure Firewall can be used for centralized inspection of inter-subnet traffic.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Azure Firewall provides stateful firewall as a service.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Secure networking — This question tests Secure networking — Azure Firewall provides stateful firewall as a service..
What is the correct answer to this question?
The correct answer is: Azure Firewall — Azure Firewall is a managed, cloud-based network security service that provides full Layer 3–7 inspection and can filter traffic based on FQDNs in network and application rules. It can inspect all traffic between subnets in a virtual network (via forced tunneling or routing) and supports threat intelligence-based filtering for malicious patterns, making it the correct choice for this requirement.
What should I do if I get this AZ-500 question wrong?
Review azure Firewall provides stateful firewall as a service., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Azure Firewall provides stateful firewall as a service.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has an Azure virtual network with multiple subnets hosting different application tiers. They need to inspect and filter all outbound traffic from VMs to the internet, and they must be able to allow or deny traffic based on fully qualified domain names (FQDNs). Which Azure networking service should they deploy?
medium
✓ A.Azure Firewall.
B.Network Security Groups (NSGs).
C.Azure Application Gateway.
D.Azure VPN Gateway.
Why A: Azure Firewall is a managed, cloud-based network security service that can inspect and filter outbound traffic from Azure virtual networks to the internet. It supports application rules based on fully qualified domain names (FQDNs), allowing or denying traffic by FQDN, which directly meets the requirement. Unlike simpler filtering options, Azure Firewall provides stateful inspection and integrates with Azure Monitor for logging.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.