Question

A global manufacturing firm hosts several VMs in an Azure VNet. Corporate security policy mandates that ALL outbound internet traffic from cloud workloads be inspected by the on-premises next-generation firewall stack before reaching the internet, with full logging for audit. The firm already has redundant ExpressRoute circuits to the on-premises data center. Which connectivity design should the network architect recommend to enforce this backhaul internet inspection requirement?

Accepted Answer

Configure forced tunneling to advertise a 0.0.0.0/0 default route to the VNet over ExpressRoute (or BGP), directing all internet-bound traffic back to on-premises for inspection

Answer

Deploy Azure NAT Gateway on each subnet so workloads egress directly to the internet with a static public IP

Answer

Enable a VNet service endpoint for internet-facing PaaS services and rely on default system routes

Answer

Attach a public IP to each VM and use Azure DDoS Protection Standard to inspect outbound flows