mediumMultiple ChoiceObjective-mapped
Zero Trust Network: Hub-and-Spoke with Firewall for Encryption and Inspection
A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?
Quick Answer
The answer is to use a hub-and-spoke topology with a firewall appliance in the hub. This configuration is correct because Zero Trust network encryption inspection requires that all traffic between virtual networks be forced through a central inspection point, eliminating any possibility of direct, unmonitored communication. By deploying Azure Virtual Network Manager to establish a hub-and-spoke model, you ensure that inter-VNet traffic is routed through the firewall, which can enforce encryption and perform deep packet inspection. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how to implement network segmentation and inspection without relying on perimeter-based security—a common trap is assuming that Azure’s default VNet peering alone satisfies Zero Trust, but it lacks mandatory inspection. Remember the key principle: in Zero Trust, no traffic is trusted by default, so the hub firewall must be the only path. Memory tip: “Hub the traffic, or fail the inspection.”
⚠ Common exam trap
Watch out — candidates often assume VNet peering with NSGs is sufficient for Zero Trust, but NSGs cannot inspect or encrypt traffic, and peering itself does not enforce inspection—only a hub-and-spoke topology with a firewall appliance can meet both encryption and inspection requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a hub-and-spoke topology with a firewall appliance in the hub
In a Zero Trust network strategy, all traffic must be encrypted and inspected regardless of source. A hub-and-spoke topology with a firewall appliance in the hub forces all inter-VNet traffic through the firewall, enabling deep packet inspection and encryption enforcement. Azure Virtual Network Manager (AVNM) can deploy this topology and route traffic via the hub, ensuring no direct VNet-to-VNet communication bypasses inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VNet peering between all VNets and use network security groups
Why it's wrong here
VNet peering does not encrypt traffic and NSGs do not provide inspection.
- ✗
Use a mesh topology with direct connectivity between VNets
Why it's wrong here
Mesh topology does not force traffic through a firewall.
- ✓
Use a hub-and-spoke topology with a firewall appliance in the hub
Why this is correct
Hub-and-spoke with firewall ensures traffic is routed through the firewall for inspection.
- ✗
Configure service endpoints for each VNet
Why it's wrong here
Service endpoints are for accessing Azure PaaS services, not for inter-VNet traffic inspection.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?
medium- A.Azure Front Door
- B.Azure Bastion
- ✓ C.Azure Firewall
- D.Azure DDoS Protection
Why C: Azure Firewall is a managed, cloud-based network security service that provides inbound and outbound traffic inspection and logging for all traffic between on-premises networks and Azure, regardless of source or destination. It supports application and network-level filtering, threat intelligence-based filtering, and integrates with Azure Monitor for comprehensive logging, making it the correct choice for a Zero Trust network strategy that requires full traffic inspection and logging.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.