An organization deploys an Azure Machine Learning workspace with a compute cluster for model training. The security team requires that all outbound traffic from training jobs must be inspected by Azure Firewall. How should this network architecture be configured?
Select an answer to reveal the explanation.
Short Explanation
You need to put the Azure ML workspace in a customer-managed VNet and add a UDR on the compute subnet that sends outbound traffic to the Azure Firewall private IP. That forces training job traffic through the firewall so it can be inspected.
Full Explanation
The correct approach is to configure the Azure ML workspace to use a customer-managed VNet and add a User Defined Route (UDR) on the compute subnet with 0.0.0.0/0 pointing to the Azure Firewall private IP as the next hop. This forces all training job outbound traffic through the firewall for inspection. The option that says to enable Azure ML managed network outbound rules to route traffic through Azure Firewall is incorrect because Azure ML managed network outbound rules define allowed outbound traffic but do not route traffic through Azure Firewall; they use Microsoft-managed network controls. The option that says to configure Azure Firewall as the default gateway in the Azure ML compute cluster network settings is incorrect because Azure ML compute cluster network settings do not provide a 'default gateway' configuration option for Azure Firewall; this routing is done through UDRs at the VNet or subnet level. The option that says to deploy the Azure ML workspace in a dedicated VNet with no NSG rules, relying on Azure Firewall for all filtering, is incorrect because removing NSGs without proper UDR routing does not ensure traffic inspection by Azure Firewall.