AZ-900 Describe Azure architecture and services Practice Question
Which Azure networking feature allows you to filter outbound internet traffic from Azure VMs using a managed cloud firewall?
⚠ Common exam trap
Watch out — candidates often confuse Network Security Groups (NSGs) with a managed firewall, but NSGs lack the centralized management, application-layer inspection, and FQDN filtering capabilities that Azure Firewall provides, making Azure Firewall the correct answer for a 'managed cloud firewall' that filters outbound internet traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Firewall
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability, allowing you to centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Specifically, it can filter outbound internet traffic from Azure VMs by inspecting traffic at Layers 3-7 of the OSI model, which is precisely what the question asks for.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is a mitigation service that safeguards Azure resources from high-volume DDoS attacks targeting network availability. It detects and blocks attack traffic automatically but is limited to inbound volumetric attacks and does not provide customizable outbound filtering rules. It also lacks FQDN-based allowlisting or access control mechanisms, so it cannot be used for the outbound network filtering described in this scenario.
- ✓
Azure Firewall
Why this is correct
Azure Firewall is a managed, cloud-native network firewall that provides centralized, stateful filtering of both outbound and inbound traffic. It supports FQDN-based rules, network rules based on IP/port/protocol, and integrates with Azure Monitor for logging and analytics. Threat intelligence filters can also block malicious traffic, making it the correct choice for advanced network-layer filtering.
- ✗
Network Security Groups (outbound rules)
Why it's wrong here
Network Security Groups (NSGs) offer distributed, basic stateful filtering based on source/destination IP, port, and protocol, but they cannot filter outbound traffic by fully qualified domain names. While outbound rules can use service tags to simplify IP management, they still rely on IP addresses rather than FQDNs. Furthermore, NSGs lack centralized logging and advanced threat intelligence features, making them insufficient for scenarios requiring granular egress control.
- ✗
Azure Web Application Firewall
Why it's wrong here
Azure Web Application Firewall (WAF) is a specialized layer-7 protection service that defends web applications from attacks such as SQL injection and cross-site scripting. It is deployed with Application Gateway or Front Door and only inspects inbound HTTP/HTTPS traffic to the web app. It does not filter general outbound network traffic or provide FQDN-based rules for non-HTTP protocols, so it cannot meet the requirement for comprehensive network-layer filtering.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.