A municipality has many branches, many regions, and a requirement for a managed any-to-any hub with integrated firewall. What architecture should the security engineer recommend?
Select an answer to reveal the explanation.
Short Explanation
Too many branches and regions for a DIY peering quilt. Grab Virtual WAN with a secured virtual hub and let the managed any-to-any fabric carry the firewall.
Full Explanation
Virtual WAN with a secured virtual hub provides a managed any-to-any connectivity fabric with integrated Azure Firewall for municipalities that have many branches, many regions, and a requirement for centralized inspection—reducing hand-built peering, gateway transit, and UDR sprawl in every region. That is the architecture to recommend when those scale and management pressures dominate.
Peering every VNet to every other VNet with no hub firewall fails manageability and inspection. Deploying only host firewalls on branch routers and avoiding Azure hub inspection fails the integrated firewall requirement. Insisting classic hub-spoke peering, gateway transit, and UDRs in every region are the only acceptable pattern ignores Virtual WAN as a first-class AZ-500 architecture for large branch estates.
Exam caveat: classic hub-spoke remains valid at smaller scale; Virtual WAN secured hubs shine for large multi-region branch meshes. Operational check: design secured virtual hubs per region needs, connect branches and VNets, enable routing intent, validate any-to-any plus deny policies, and compare operational overhead against the old DIY mesh. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.