Two subnets in an Azure virtual network must stop talking to each other. Internet-bound traffic from those subnets must keep using Azure's internet path, not the campus. Which control fits?
Select an answer to reveal the explanation.
Short Explanation
You need a lock between two rooms, not a rule that sends every outbound packet back to campus. Use a network security group to deny traffic between the subnets, while leaving Azure’s internet path alone.
Full Explanation
East-west traffic between two subnets in a virtual network is controlled by a network security group or a similar in-cloud policy. A deny rule stops the subnets from communicating while leaving Azure’s internet path in place. Forced tunneling of 0.0.0.0/0 through the campus VPN gateway sends internet-bound traffic to campus, contrary to the requirement to keep that traffic on Azure’s internet path; it also does not specifically isolate the two subnets. A longer IKE lifetime changes the timing of the campus VPN’s security association, but subnet-to-subnet traffic does not use that VPN. Microsoft peering on ExpressRoute exchanges routes for Microsoft public services; it does not filter traffic between subnets inside the virtual network. Exam caveat: network security groups are stateful, and a deny rule must cover the direction the flow actually takes; a rule on the wrong subnet can leave the reverse path open. Practical check: test communication between the subnets and confirm it fails, then test a public destination from each subnet and verify that traffic still exits through Azure rather than the campus firewall.