hardMultiple SelectObjective-mapped
SC-100 Practice Question: Designing a network security strategy for a…
You are designing a network security strategy for a multicloud environment that includes Azure and Amazon Web Services (AWS). The company requires that all traffic between the two clouds be encrypted and inspected for threats. You need to recommend a solution that meets the following requirements: - Minimize latency. - Use Microsoft-provided security services where possible. - Ensure traffic is inspected at Layers 3-7. Which TWO options should you include in your design?
⚠ Common exam trap
Candidates may confuse Azure Front Door (a global load balancer and WAF for web traffic) with a general-purpose inter-cloud inspection solution, overlooking that it only handles HTTP/HTTPS and cannot inspect non-web protocols or traffic between cloud networks. Similarly, they might think only one cloud-side solution is needed, but in a multicloud environment, both sides must provide inspection for true end-to-end security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Virtual WAN with a secured hub that includes Azure Firewall and Firewall Manager.
Azure Virtual WAN with a secured hub integrates Azure Firewall and Firewall Manager to provide a centralized, Microsoft-managed inspection point for traffic between Azure and AWS. This design minimizes latency by routing inter-cloud traffic through Microsoft's global backbone rather than over the public internet, and it supports Layer 3-7 inspection via Azure Firewall's application and network rules. Similarly, on the AWS side, AWS Transit Gateway with AWS Network Firewall provides a centralized, managed inspection point for traffic between VPCs and other connected networks, including inter-cloud traffic. It also minimizes latency by routing traffic through AWS's global infrastructure and supports Layer 3-7 inspection. Together, these two components satisfy all requirements: encrypted and inspected traffic between the two clouds, minimized latency, use of Microsoft-provided services where possible (Azure Firewall), and Layers 3-7 inspection on both sides.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Virtual WAN with a secured hub that includes Azure Firewall and Firewall Manager.
Why this is correct
Azure Virtual WAN is a global transit networking service that interconnects VNets, branches, and remote sites through a full mesh of Microsoft-managed hubs. When deployed as a secured hub, it embeds Azure Firewall as a centralized, scalable L3-7 inspection point, and Firewall Manager enforces consistent security policies across all hubs and virtual networks. This architecture dynamically routes inter-cloud and branch traffic through the firewall, providing transit connectivity and comprehensive inspection that exactly matches the multicloud network security requirement.
- ✗
Azure Firewall with forced tunneling to an on-premises inspection appliance.
Why it's wrong here
Forcing Azure Firewall to tunnel internet-bound traffic to an on-premises inspection appliance routes all egress through a dedicated IP but does not create any transit path between clouds or between VNets. This design adds significant latency for cloud-to-cloud traffic, creates a dependency on on-premises infrastructure availability, and still fails to secure inter-cloud east-west flows because Azure Firewall in forced-tunnel mode only inspects outbound traffic, not forwarded traffic from other clouds. Therefore, it lacks the global transit capability needed for a multicloud architecture.
- ✗
Azure Policy with built-in network security policies.
Why it's wrong here
Azure Policy is a governance and compliance service that evaluates resources against rules and can audit or enforce configuration, such as requiring specific Network Security Group settings or tagging. However, it operates at the control plane and does not examine live network packets or make real-time traffic decisions, so it cannot inspect, filter, or route traffic between clouds. While it can enforce that firewall rules exist, it is not a substitute for actual network traffic inspection or transit connectivity.
- ✗
Azure Front Door Premium with Web Application Firewall (WAF) policy.
Why it's wrong here
Azure Front Door Premium is a global HTTP(S) application delivery and acceleration service, and its Web Application Firewall protects web workloads only at layer 7 against SQL injection, XSS, and similar application-layer attacks. It lacks the capability to inspect non-HTTP protocols, arbitrate IP-level traffic across clouds, or provide transitive routing between VNets and on-premises networks, so it cannot serve as the core of a general network security strategy. This makes it specific to web application protection rather than network-wide inspection.
- ✓
AWS Transit Gateway with AWS Network Firewall for inspection.
Why this is correct
AWS Transit Gateway is a regional hub that interconnects multiple VPCs and on-premises networks, and when combined with AWS Network Firewall, it offers centralized L3-7 filtering, threat prevention, and traffic inspection for all VPC-to-VPC and VPC-to-branch traffic. This combination effectively secures the AWS portion of a multicloud environment, providing transitive connectivity and inspection similar to Azure's secured Virtual WAN. As a valid alternative, it should be included in the solution for the AWS side, though it does not extend seamlessly to Azure without additional cross-cloud tie-in.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.