A software vendor, CloudPatch, uses Azure Firewall to manage outbound OS updates for hundreds of Windows servers. They want to allow Windows Update, Microsoft Update, and Windows Defender update traffic but deny all other internet egress. Which Azure Firewall configuration using FQDN tags is the most maintainable and secure approach?

The correct approach leverages Azure Firewall's FQDN tags for maintainability and security. The 'WindowsUpdate' FQDN tag encompasses all necessary Microsoft update domains, including Windows Update, Microsoft Update, and Windows Defender. The 'AzureActiveDirectory' tag is crucial for authentication and identity services often required by Windows updates. Allowing traffic on ports 80/443 covers standard HTTP/HTTPS communication. A higher-priority DENY rule ensures all other internet egress is blocked, enforcing a secure posture. Using network FQDN tags with 'AzureService' is too broad and less specific than application rules for this scenario. Explicitly listing hostnames is less maintainable than using FQDN tags, which are designed for this purpose. Relying solely on NSGs and IP ranges is not as granular or maintainable as Azure Firewall FQDN tags, and doesn't address FQDN filtering directly.