You need to implement network security to meet the security requirements and the performance requirements. Which two actions should you perform? Each…

A comprehensive network security strategy for Azure Virtual Desktop (AVD) employs a defense-in-depth approach. This involves two primary actions:

1. Deploying Network Security Groups (NSGs) and Application Security Groups (ASGs): NSGs are fundamental for micro-segmentation. They filter traffic at the subnet and network interface level, controlling inbound, outbound, and east-west traffic for the session host VMs. ASGs simplify rule management by grouping VMs, such as all hosts in a pool, allowing for consistent policy application.

2. Deploying Azure Firewall: AVD session hosts require outbound internet access to specific FQDNs for the service to function. Azure Firewall is the recommended solution to centrally manage, filter, and log this outbound traffic, ensuring hosts can only reach required endpoints. Deploying two instances with Azure Firewall Manager ensures a highly available, centrally managed, and robust solution suitable for production environments.

B. Filter traffic by using outbound rules.

This describes a configuration step within a security tool (like an NSG or Firewall), not the deployment of the complete solution itself.

C. Filter traffic by using infrastructure rules.

This is a specific, advanced feature of Azure Firewall Premium. The primary action is deploying the firewall, not just configuring one type of rule.

D. Filter traffic by using inbound rules.

This describes a configuration step within a security tool (like an NSG), not the deployment of the complete solution itself.

F. Deploy an Azure Firewall instance and Azure Firewall Manager.

While correct in principle, option A is superior as it specifies two instances, implying a highly available design which is a best practice for production workloads.

1. Microsoft Learn. (2023). Security best practices for Azure Virtual Desktop. In the "Network security" section

it states

"Use a network security group (NSG) to protect your Azure Virtual Desktop environment... You can also use Azure Firewall to protect your environment and filter outbound traffic." This supports the use of both NSGs (Option E) and Azure Firewall (Option A).

2. Microsoft Learn. (2023). Use Azure Firewall to protect Azure Virtual Desktop deployments. This document explicitly recommends the architecture combining Azure Firewall for outbound traffic and NSGs. The "Prerequisites" and "Deploy the Firewall and policy" sections detail the deployment of the firewall

and the architecture diagram shows the NSG on the session host subnet.

3. Microsoft Learn. (2023). Application security groups. This document explains

"Application security groups enable you to configure network security as a natural extension of an application's structure

allowing you to group virtual machines and define network security policies based on those groups." This validates the use of ASGs with NSGs as a best practice (Option E).

4. Microsoft Learn. (2023). What is Azure Firewall? In the "Features" section

it highlights "Built-in high availability

" which is achieved through its design. Deploying multiple instances or using a zone-redundant configuration (implied by "two instances") enhances this for maximum uptime

supporting the choice of Option A for a robust solution.