Diagram
A system architecture diagram showing spoke VNets and branch sites routing traffic through custom route tables in a secured virtual hub to Azure Firewall, with Firewall Manager linking policy and a default route enabling forced tunneling to the Internet.
Design and deploy secured virtual hubs with policy-based routing and firewall integration
Azure Virtual WAN is a global transit network service that uses a hub-and-spoke architecture. A secured virtual hub adds a firewall instance, such as Azure Firewall or a partner network virtual appliance (NVA), directly inside the hub to inspect and filter all inter-spoke, branch, and Internet traffic. This approach centralizes security controls and enforces a Zero Trust stance by denying by default and only allowing traffic that matches explicit rules. Virtual hubs connect in a full mesh, providing any-to-any connectivity across branches, VNets, and users. The hub acts as the routing fabric where policies can be consistently applied.
Domain 5 of 9
2 practice questions
Practice this DomainLast updated