Internet traffic from a virtual network must be inspected in the cloud. Backhaul to campus is forbidden. East-west traffic inside the virtual network is out of scope. What meets the internet requirement?
Select an answer to reveal the explanation.
Short Explanation
The inspection has to happen in the cloud, so you do not haul the internet back to campus. You put a cloud firewall on the virtual network's path to the internet. A default route to campus is the backhaul you were told not to build.
Full Explanation
Inspection that must stay in the cloud belongs on the virtual network's internet path, such as a cloud firewall or equivalent policy the packets actually traverse. A default route through the VPN gateway sends that internet traffic to campus, which the requirement forbids. An east-west deny affects subnet-to-subnet traffic that was declared out of scope, and it does not inspect internet egress. The IKE lifetime changes rekey on the campus VPN. Internet flows that never cross that VPN are not inspected by it. Exam caveat: the workload route to the internet has to hit the firewall. A firewall in a subnet the default route skips does not see the traffic. Operational check: an internet session from a workload should appear in the cloud firewall log and should not appear on the campus firewall.