AZ-900 Describe Azure architecture and services Practice Question
A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?
⚠ Common exam trap
Many candidates confuse Network Security Groups (NSGs) with Azure Firewall, assuming NSGs can perform application-layer filtering and threat intelligence-based blocking, but NSGs operate only at layers 3 and 4 (IP and port) and cannot inspect or log outbound traffic based on FQDNs or threat feeds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed platform service that enables secure, seamless RDP and SSH connectivity to Azure virtual machines directly through the Azure portal, using TLS within the Azure backbone. It acts as a jump host or bastion host, but it does not perform traffic inspection, apply FQDN-based allow/deny rules, or provide centralized logging of outbound traffic flows. Because it only brokers interactive administrative connections, it cannot serve as a network firewall for outbound traffic filtering.
When this WOULD be correct
An exam question asking for a secure, managed jump server to access Azure VMs in a virtual network without exposing public IPs, with no requirement for outbound traffic inspection or FQDN filtering.
- ✓
Azure Firewall
Why this is correct
Azure Firewall is a managed, cloud-native firewall service that provides centralized, stateful inspection of both inbound and outbound traffic at the network level. It supports FQDN-based rules, allowing or denying traffic based on fully qualified domain names rather than just IP addresses, and can integrate with Microsoft Threat Intelligence to block domains associated with known malicious activity. These capabilities directly satisfy the requirement for outbound traffic control with FQDN filtering and threat detection.
- ✗
Network Security Group (NSG)
Why it's wrong here
NSGs filter traffic at the subnet or NIC level based on source/destination IP addresses, ports, and protocols. They do not support FQDN-based rules, centralized logging, or threat intelligence-based filtering. They are not designed for centralized outbound inspection.
When this WOULD be correct
An NSG would be correct in a scenario where the requirement is to allow or deny traffic between subnets within a virtual network based on source/destination IP addresses and ports, without needing FQDN filtering, centralized inspection, or threat intelligence integration.
- ✗
Application Gateway
Why it's wrong here
Application Gateway is a layer 7 load balancer and web application firewall (WAF) for HTTP/HTTPS traffic. It is not designed for general network-level inspection of all outbound traffic and does not provide broad FQDN-based filtering for all protocols.
When this WOULD be correct
A question requiring a service to load balance HTTP/HTTPS traffic, provide SSL termination, URL-based routing, or a web application firewall (WAF) to protect web applications from common exploits. For example: 'Which Azure service should be used to route user requests to different backend pools based on the URL path?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure FirewallCorrect answer▾
Why this is correct
Azure Firewall is a managed, cloud-native firewall service that provides centralized, stateful inspection of both inbound and outbound traffic at the network level. It supports FQDN-based rules, allowing or denying traffic based on fully qualified domain names rather than just IP addresses, and can integrate with Microsoft Threat Intelligence to block domains associated with known malicious activity. These capabilities directly satisfy the requirement for outbound traffic control with FQDN filtering and threat detection.
✗Azure BastionWrong answer — click to see why▾
Why this is wrong here
Azure Bastion provides secure RDP/SSH access to VMs without public IPs, but it does not inspect or filter outbound internet traffic, log destinations, or enforce FQDN-based rules.
★ When this WOULD be the correct answer
An exam question asking for a secure, managed jump server to access Azure VMs in a virtual network without exposing public IPs, with no requirement for outbound traffic inspection or FQDN filtering.
Why candidates choose this
Candidates may confuse Bastion's secure access capability with general network security, or think it can inspect traffic because it sits in the virtual network.
✗Network Security Group (NSG)Wrong answer — click to see why▾
Why this is wrong here
Network Security Groups (NSGs) filter traffic based on IP addresses and ports, not FQDNs, and cannot inspect or log outbound traffic using threat intelligence feeds. They also lack centralized logging and FQDN-based rules required by the question.
★ When this WOULD be the correct answer
An NSG would be correct in a scenario where the requirement is to allow or deny traffic between subnets within a virtual network based on source/destination IP addresses and ports, without needing FQDN filtering, centralized inspection, or threat intelligence integration.
Why candidates choose this
Candidates may think NSGs can handle outbound traffic filtering because they are commonly used for network security, but they overlook the need for FQDN-based rules and centralized inspection that NSGs cannot provide.
✗Application GatewayWrong answer — click to see why▾
Why this is wrong here
Application Gateway is a Layer 7 load balancer for HTTP/HTTPS traffic, not a firewall. It cannot inspect all outbound traffic (e.g., non-HTTP protocols), log destinations, or reject traffic based on threat intelligence feeds.
★ When this WOULD be the correct answer
A question requiring a service to load balance HTTP/HTTPS traffic, provide SSL termination, URL-based routing, or a web application firewall (WAF) to protect web applications from common exploits. For example: 'Which Azure service should be used to route user requests to different backend pools based on the URL path?'
Why candidates choose this
Candidates may confuse Application Gateway's WAF feature with a full firewall, or think its Layer 7 inspection capabilities can replace a network firewall for outbound traffic filtering.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Azure Firewall
Azure Firewall is a cloud-based network security service that protects your virtual networks in Microsoft Azure by filtering traffic based on rules you define.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.