AZ104-Q: force outbound traffic through inspection
A workload subnet must send all Internet-bound traffic through Azure Firewall. What routing change is required?
- A) Add an inbound NSG allow rule.
- B) Create a private DNS zone.
- C) Associate a route table with a 0.0.0.0/0 route whose next hop is the firewall virtual appliance. ✓
- D) Peer the VNet to itself. Answer: C. A user-defined default route directs outbound traffic to the inspection appliance. Why not the others: NSGs filter; DNS resolves names; self-peering is not a forwarding path.