Every internet flow from an Azure virtual network must leave through the campus firewall. East-west traffic inside the virtual network can stay local. What meets the internet requirement?
Select an answer to reveal the explanation.
Short Explanation
You want the virtual network's internet door to be the campus firewall. You send a default route through the VPN gateway toward campus, and you leave the local east-west traffic alone. Putting a public address on each workload does the opposite.
Full Explanation
Backhaul of cloud internet egress sends 0.0.0.0/0 from the virtual network through the VPN gateway to the campus firewall, which is the forced-tunneling pattern. East-west traffic that is more specific than the default can stay inside the virtual network, matching the requirement. An east-west deny between subnets that still need to talk breaks the traffic the firm said can stay local, and it does not send internet flows to campus. A public address on each workload lets those hosts leave directly and removes the campus hop. The IKE lifetime does not attract internet flows. The route does. Exam caveat: the campus must be ready to receive and return that default. Advertising 0.0.0.0/0 toward Azure without a working campus path blackholes the virtual network's internet. Operational check: a workload's internet session should arrive on the campus firewall, and a session between the two subnets should not.