NovaBank requires all internet-bound traffic from Azure VNets to be inspected by an on-premises security appliance. They deployed Azure Firewall in the hub and want to force-tunnel outbound traffic through an ExpressRoute circuit to the appliance, while still allowing Azure service traffic (e.g., Azure SQL) to go directly to Azure without hairpinning through on-prem. What combination of Azure Firewall and routing features meets this requirement?

The correct solution leverages Azure Firewall's forced tunneling capability to direct all internet-bound traffic through the on-premises security appliance via the ExpressRoute gateway. By setting Azure Firewall's forced tunneling to point to the Virtual Network Gateway, the firewall sends 0.0.0.0/0 traffic to the gateway. The on-premises appliance then receives this traffic because a default route (0.0.0.0/0) is advertised via BGP over ExpressRoute. To prevent Azure service traffic from hairpinning, IP-based route exceptions (using Azure service tags) are configured on the on-premises appliance, allowing this specific traffic to egress directly to Azure. The first incorrect option misrepresents Azure Firewall forced tunneling configuration and incorrectly suggests UDR exceptions for service tags, which are not applied in that manner for forced tunneling. The second option incorrectly suggests UDRs in spoke VNets and disabling SNAT, which doesn't align with the hub-spoke model for centralized inspection or the requirement for Azure Firewall. The fourth option's routing of 0.0.0.0/0 to the Internet contradicts the forced tunneling requirement, and Azure Firewall Policy doesn't bypass forced tunneling in the way described.