Question

Your company runs a hub-and-spoke topology with an Azure Firewall Standard in the hub, managed through an Azure Firewall Policy. Security requires that outbound HTTP/HTTPS traffic from all spoke workloads be blocked to any website categorized as 'Gambling' or 'Social Networking', while allowing all other web browsing. You must implement this with the least administrative effort and without manually maintaining lists of FQDNs. What should you configure?

Accepted Answer

Create an application rule collection with an application rule that uses Web Categories to deny the 'Gambling' and 'Social Networking' categories.

Answer

Create a network rule collection that denies the destination IP ranges published for gambling and social networking sites.

Answer

Enable Threat Intelligence in Deny mode on the firewall policy to block the gambling and social networking categories.

Answer

Upgrade the firewall to the Premium SKU and enable TLS inspection to filter the URLs of the restricted categories.