Azure Firewall is a managed, cloud-native network security service designed to protect resources within an Azure Virtual Network (VNet). It functions by filtering inbound and outbound traffic based on configured network and application rules. As it is deployed within a VNet, its primary role is to safeguard the network itself and the resources contained within it, such as Azure virtual machines. It can inspect and control traffic flowing between virtual networks, from on-premises networks, and to the internet, thereby providing a centralized protection layer for VNet-based workloads.

B. Azure Active Directory (Azure AD) users are identity objects, not network resources. They are protected by identity-centric services like Azure AD Identity Protection and Conditional Access.

C. Microsoft Exchange Online is a Software as a Service (SaaS) application. It is protected by dedicated services like Exchange Online Protection, not by a customer-managed VNet firewall.

E. Microsoft SharePoint Online is a Software as a Service (SaaS) application. Its security is managed within the Microsoft 365 ecosystem, not by Azure Firewall in a customer's VNet.

1. Microsoft Learn. (2023). What is Azure Firewall? "Azure Firewall is a cloud-native and intelligent network firewall security service that provides the best of breed threat protection for your cloud workloads running in Azure... It allows you to create

enforce

and log application and network connectivity policies across subscriptions and virtual networks."

2. Microsoft Learn. (2023). SC-900: Describe the security capabilities of Azure. "Azure Firewall is a managed

cloud-based network security service that protects your Azure Virtual Network resources." This module explicitly states that resources like virtual machines within a VNet are what Azure Firewall is designed to protect.

3. Microsoft Learn. (2023). Azure Firewall features. This document details features like network traffic filtering rules and DNAT (Destination Network Address Translation)

which are used to control traffic to resources such as virtual machines inside a virtual network.