Microsoft Azure Security Engineer Associate AZ-500 Practice Question

A routing intent lets you specify that all private (VNet-to-VNet) traffic entering or leaving the virtual hub must use a security provider. When you set the private traffic routing intent to Azure Firewall, Virtual WAN automatically inserts the required policies so that every spoke-to-spoke flow is sent through the firewall. The branch-to-branch toggle affects site connections, not VNet traffic. Simply associating the default route table with VNet connections or enabling BGP propagation does not redirect VNet traffic through the firewall and therefore would still require custom routes in each VNet.