Branch and spoke traffic in Virtual WAN can skip the hub firewall if routing is left at defaults. What control should the security engineer set so inspection is mandatory?
Select an answer to reveal the explanation.
Short Explanation
Default Virtual WAN routing can dodge the firewall like a side canal. Set routing intent so Internet and private traffic must swim through the secured hub.
Full Explanation
Routing intent, also called routing policies, in Virtual WAN forces specified traffic classes—Internet and or private traffic—through the hub firewall so branches and spokes cannot skip inspection when defaults would otherwise allow bypass. Configure routing intent so inspection is mandatory for the canal authority’s Virtual WAN design.
Attaching a unique UDR on every spoke as the only supported Virtual WAN inspection method fails: routing intent is the Virtual WAN-centric control for forcing traffic through the secured hub firewall. Disabling all hub connections so branches use only the public Internet fails security. Removing Azure Firewall from the secured hub and relying on NSG default allows fails inspection requirements.
Exam caveat: without routing intent, some architectures allow paths that bypass the firewall—know why intent exists. Operational check: set routing intent for Internet and or private traffic, verify effective routing sends flows to Firewall, attempt a bypass path, and confirm it is forced through inspection. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.