Azure Firewall Premium vs Standard: AZ-500 Exam Guide

Standard vs Premium: Feature Comparison

IDPS: Alert vs Deny Mode

IDPS in Premium SKU inspects traffic against Microsoft's signature database. Two operational modes:

• Alert mode: Logs matching traffic, does not block it. Use during initial deployment to understand baseline.
• Alert and Deny mode: Logs and blocks matching traffic. Use in production.

Exam tip: IDPS operates on East-West (lateral) traffic as well as North-South. It is not limited to internet-bound traffic.

TLS Inspection

Premium Firewall can decrypt, inspect, and re-encrypt TLS traffic. Requirements:

1. An intermediate CA certificate stored in Azure Key Vault
2. A managed identity granted access to the Key Vault certificate
3. The Firewall Policy configured to reference that Key Vault certificate

Exam trap: The intermediate CA cert must be trusted by clients. If using an enterprise CA, deploy the cert to client trust stores via Group Policy.

Forced Tunneling

To route all internet-bound firewall traffic through an on-premises NVA, configure forced tunneling. Requirements:

• Create a AzureFirewallManagementSubnet subnet: this keeps management traffic out of the forced tunnel
• A route table pointing 0.0.0.0/0 to the on-premises NVA

Exam tip: Without AzureFirewallManagementSubnet, forced tunneling breaks firewall management connectivity.