Every hub firewall must share a baseline (deny Internet RDP, threat intel on) while each region adds its own FQDNs. What should the security engineer use?
Select an answer to reveal the explanation.
Short Explanation
One parent Firewall Policy for the shared baseline, child policies for regional FQDNs, steered by Firewall Manager. Stop Xeroxing classic rules onto every hub.
Full Explanation
Shared baselines across every hub firewall—deny Internet RDP, threat intelligence on—with regional FQDN additions are the job of Azure Firewall Manager and Firewall Policy. Use a parent Firewall Policy for the common baseline and child policies for regional additions so inheritance stays consistent instead of copy-pasting classic rules onto each canal hub.
Copying classic Azure Firewall rule collections by hand onto every hub fails by concept: manual duplication drifts and is not the current centralized policy model. Replacing firewall baselines with an Azure Policy initiative that only audits resource tags fails by concept: Azure Policy governs Azure resource compliance; it does not evaluate Firewall FQDN/network/DNAT traffic. Attaching a single NSG to all hub firewalls and disabling Firewall Manager fails by concept: NSGs do not provide parent/child Firewall Policy inheritance or FQDN application-rule management.
Exam caveat: Firewall Policy hierarchy (parent/child) via Firewall Manager is the AZ-500 answer for shared-plus-regional rule governance. Operational check: author a parent policy with deny Internet RDP and threat intel settings, attach child policies with regional FQDNs, associate policies to each hub firewall, and verify inherited and local rules both evaluate as intended.