Does the Applicant employ external/perimeter and internal firewalls?
Everyone has a perimeter firewall. The word that carries the question is internal, because that is what constrains an attacker who is already inside.
What the carrier is actually asking
The carrier is asking about filtering at the boundary and between internal zones. A perimeter device protects against the outside; internal filtering limits what a compromised workstation can reach. The second is what changes the outcome of an intrusion that has already begun.
Why it is underwritten
Initial access is a matter of when. What determines the size of the loss is how far the attacker travels afterwards. Internal filtering is the control that makes lateral movement slow, noisy, or impossible, and carriers weight it accordingly.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Cloud network controls are directly measurable. On-premises firewalls are attested and should be supported by a configuration export.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Network security groups and their default rules | Deny by default with explicit allow rules, rather than permissive rules inherited from a template |
| Azure | Azure Firewall or network virtual appliance at the boundary | A filtering point for egress as well as ingress, since command and control traffic leaves rather than arrives |
| Azure | Public network access settings on storage, databases, and key vaults | Public access disabled with private endpoints, which is the cloud equivalent of not exposing internal services |
| Azure | Subnet design and network security group assignment | Workloads separated into subnets with filtering between them, not a single flat virtual network |
| On-premises | Perimeter and internal firewall configuration and rule base | Rule base with deny-by-default, reviewed. Attested |
Most firewall answers describe inbound control. Outbound filtering is what interrupts command and control and data exfiltration, and it is absent or fully permissive in a large share of environments. Mentioning it distinguishes your answer.
What a defensible yes requires
- Filtering exists at the boundary and between internal zones.
- Default posture is deny, with allow rules that have owners and justifications.
- Outbound traffic is filtered, not only inbound.
- Cloud services are reachable through private endpoints rather than public addresses.
- Rule bases are reviewed, since accumulated rules are how a deny-by-default posture becomes permissive.
How this answer goes wrong
A capable perimeter firewall protects a completely flat internal network, so any compromised device can reach every server. Or cloud workloads sit behind a network security group whose rules were copied from a template and allow far more than the workload needs.
Frequently asked
Do cloud network security groups count as firewalls?
Yes, for this question. They are the filtering layer in a cloud estate and they are directly measurable, which makes the answer evidenced rather than asserted.
What if we are fully cloud with no offices?
Answer for the cloud estate and say the perimeter is identity rather than network. That is a coherent modern answer when Conditional Access carries the weight.
How often should rules be reviewed?
Annually at minimum. A separate question asks about this directly, so the two answers should agree.
Is a next-generation firewall expected?
Not required. Capability matters more than product category, and internal segmentation matters more than either.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture