Question

Your company runs a secured hub in Azure Virtual WAN protected by Azure Firewall Premium. The security team wants to consolidate all firewall configuration for five regional hubs into a single, centrally managed policy while still allowing each hub to have region-specific network rules that override the shared baseline. Which Firewall Manager configuration approach meets these requirements with the least administrative effort?

Accepted Answer

Create one parent Azure Firewall Policy containing shared rules, then create a child policy per region that inherits the parent and adds region-specific rule collection groups with lower priority numbers.

Answer

Create a separate standalone Azure Firewall Policy for each hub and manually duplicate the shared baseline rules into every policy.

Answer

Create one Azure Firewall Policy and associate it with all five firewalls, adding region-specific rules as classic rules directly on each firewall instance.

Answer

Create one parent policy and configure DNAT rules in the parent so each region inherits identical destination translation without child policies.