Question 505 of 981
AZ-900 Describe Azure architecture and services Practice Question
Which Azure networking feature allows you to filter outbound internet traffic from Azure VMs using a managed cloud firewall?
⚠ Common exam trap
Watch out — candidates often confuse Network Security Groups (NSGs) with a managed firewall, but NSGs lack the centralized management, application-layer inspection, and FQDN filtering capabilities that Azure Firewall provides, making Azure Firewall the correct answer for a 'managed cloud firewall' that filters outbound internet traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability, allowing you to centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Specifically, it can filter outbound internet traffic from Azure VMs by inspecting traffic at Layers 3-7 of the OSI model, which is precisely what the question asks for.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is a mitigation service that safeguards Azure resources from high-volume DDoS attacks targeting network availability. It detects and blocks attack traffic automatically but is limited to inbound volumetric attacks and does not provide customizable outbound filtering rules. It also lacks FQDN-based allowlisting or access control mechanisms, so it cannot be used for the outbound network filtering described in this scenario.
- ✓
Azure Firewall
Why this is correct
Azure Firewall is a managed, cloud-native network firewall that provides centralized, stateful filtering of both outbound and inbound traffic. It supports FQDN-based rules, network rules based on IP/port/protocol, and integrates with Azure Monitor for logging and analytics. Threat intelligence filters can also block malicious traffic, making it the correct choice for advanced network-layer filtering.
- ✗
Network Security Groups (outbound rules)
Why it's wrong here
Network Security Groups (NSGs) offer distributed, basic stateful filtering based on source/destination IP, port, and protocol, but they cannot filter outbound traffic by fully qualified domain names. While outbound rules can use service tags to simplify IP management, they still rely on IP addresses rather than FQDNs. Furthermore, NSGs lack centralized logging and advanced threat intelligence features, making them insufficient for scenarios requiring granular egress control.
- ✗
Azure Web Application Firewall
Why it's wrong here
Azure Web Application Firewall (WAF) is a specialized layer-7 protection service that defends web applications from attacks such as SQL injection and cross-site scripting. It is deployed with Application Gateway or Front Door and only inspects inbound HTTP/HTTPS traffic to the web app. It does not filter general outbound network traffic or provide FQDN-based rules for non-HTTP protocols, so it cannot meet the requirement for comprehensive network-layer filtering.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.