mediumMultiple ChoiceObjective-mapped

SC-100 Designing a Zero Trust network strategy Practice Question

A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?

⚠ Common exam trap

Test-takers frequently confuse Azure Firewall with Azure Front Door or Azure Bastion, thinking that any security or access service can inspect all traffic, but only Azure Firewall provides the necessary stateful inspection and logging for all network traffic between on-premises and Azure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Firewall

Azure Firewall is a managed, cloud-based network security service that provides inbound and outbound traffic inspection and logging for all traffic between on-premises networks and Azure, regardless of source or destination. It supports application and network-level filtering, threat intelligence-based filtering, and integrates with Azure Monitor for comprehensive logging, making it the correct choice for a Zero Trust network strategy that requires full traffic inspection and logging.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global, layer-7 HTTP/S load balancing and content delivery service, not an inline traffic inspection engine. It applies WAF policies only to web traffic that enters through the configured front-end host, so it cannot capture or log arbitrary non-HTTP protocols or broader network flows between on-premises and Azure. Consequently, it fails to satisfy a zero trust requirement to inspect all traffic, regardless of protocol or path.
✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed PaaS service that brokers TLS-secured RDP/SSH connectivity directly to Azure VMs, bypassing the need for public IP exposure. It sits in the management plane, only handling interactive administrative sessions, and it is not inline on the data path for workloads. Therefore, it cannot inspect, log, or filter general network traffic between on-premises and Azure, making it irrelevant as a central inspection point.
✓
Azure Firewall
Why this is correct
Azure Firewall is a stateful, cloud-native firewall as a service that can be deployed in a hub VNet to centralize and enforce network security policies. It supports forced tunneling to route all internet-bound traffic (including traffic from on-premises via ExpressRoute/VPN) through the firewall, where it can inspect, filter, and log every session using application rules, network rules, and threat intelligence. Its built-in logging—via diagnostics, Azure Monitor, and Firewall Insights—provides the full traffic visibility required for a zero trust strategy.
✗
Azure DDoS Protection
Why it's wrong here
Azure DDoS Protection is a mitigation service that automatically absorbs volumetric, protocol, and resource-exhaustion attacks at layers 3 and 4, protecting public IP addresses from being overwhelmed. It is not an inline security policy enforcement point for day-to-day traffic inspection; it does not parse payloads, maintain state for application flows, or generate detailed logs of allowed/denied traffic beyond DDoS-related telemetry. Thus, while essential for availability, it cannot substitute for a firewall in a zero trust inspection model.

Visual reference

Go deeper

SC-100 Designing a Zero Trust network strategy Practice Question

Why each option matters

Option-by-option breakdown

Related to this question