URL filtering on VNet1: Azure Firewall's URL filtering is an Application Rule feature, not a Network Rule feature. Since VNet1 is associated with FW1, which uses Policy2, and Policy2 is a Premium policy, URL filtering is available. However, the statement asks about applying it to network rules, which is incorrect. URL filtering is a function of application rules, not network rules.

IDPS on VNet2: VNet2 is associated with FW2. FW2 is a Premium tier firewall. The Premium tier of Azure Firewall includes an IDPS, which can be used to monitor malicious activity. The statement is therefore true.

Encrypted traffic inspection: Azure Firewall can inspect encrypted traffic, but only if TLS inspection is enabled. For this to work, the client (VNet3 in this case) must trust the firewall's certificate authority, and the traffic must be routed to the firewall. The question implies that peering alone will cause encrypted traffic to be inspected. Peering simply allows connectivity; it doesn't automatically enable traffic routing through the firewall or TLS inspection. VNet3 has no firewall associated with it, so its traffic will not be inspected unless specifically routed and configured for TLS inspection, which isn't guaranteed by just peering.

Microsoft Azure Documentation. (2023). What is Azure Firewall Premium? Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/firewall/premium-features

Specifically, the section on "TLS Inspection" and "IDPS" confirms these features are part of the Premium tier.

Microsoft Azure Documentation. (2023). Azure Firewall Rules. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/firewall/rule-processing

This document clarifies the distinction between Network rules and Application rules, with URL filtering being a function of Application rules.

Microsoft Azure Documentation. (2023). Azure Virtual Network Peering. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

This source explains that VNet peering provides connectivity but does not automatically route traffic through a firewall. Specific user-defined routes (UDRs) are needed for this purpose.