Merge pull request #54124 from staleycyn/patch-3

Content drift fixes on the design network security monitoring module

Author: JamesJBarnett

learn-pr/wwl-azure/design-implement-network-security-monitoring/includes/10-implement-web-application-firewall-on-azure-front-door.md

@@ -14,7 +14,7 @@ There are two WAF policy modes: Detection and Prevention. By default, the WAF po
 
 :::image type="content" source="../media/waf-policy-modes-4a04568d.png" alt-text="Screenshot of the WAF policy modes.":::
 
-The Web Application Firewall works with the Application Gateway, Azure Front Door Service, and the Azure CDN Service.
+The Web Application Firewall works with the Application Gateway and Azure Front Door.
 
 ## Microsoft managed rule sets, rule groups, and rules
 

learn-pr/wwl-azure/design-implement-network-security-monitoring/includes/11-summary-resources.md

@@ -12,7 +12,7 @@ In this module, you explored a range of network security features.
 
 - Azure Firewall Manager provides centralized configuration and management across multiple Azure Firewall instances. Azure Firewall Manager lets you create one or more firewall policies and rapidly apply them to multiple firewalls. Firewall Manager can provide security management for secured virtual hubs and hub virtual networks. 
 
-- Web Application Firewall provides centralized protection of your web applications from common exploits and vulnerabilities. There are two WAF policy modes: Detection and Prevention. WAF works with the Application Gateway, Azure Front Door Service, and the Azure CDN Service.
+- Web Application Firewall provides centralized protection of your web applications from common exploits and vulnerabilities. There are two WAF policy modes: Detection and Prevention. WAF works with the Application Gateway and Azure Front Door.
 
 ## Learn more with Copilot
 

learn-pr/wwl-azure/design-implement-network-security-monitoring/includes/6-azure-firewall.md

@@ -16,16 +16,20 @@ Azure Firewall has three [SKUs](/azure/firewall/choose-firewall-sku): Azure Fire
 
 ### How to choose the SKU
 
-- **Basic**: Up to 250 Mbps; SMB environments; has threat intelligence in alert mode only.
-- **Standard**: Up to 30 Gbps; enterprise environments; L3–L7 filtering, DNS proxy, web categories, and threat intelligence.
-- **Premium**: Up to 100 Gbps; regulated/sensitive environments (healthcare, payment); adds TLS inspection, IDPS, full URL filtering, and PCI DSS compliance.
+All SKUs support availability zone deployment for zone-redundant high availability. All SKUs include policy analytics for tracking rule usage over time and managing redundant or conflicting rules.
+
+- **Basic SKU**: Up to 250 Mbps; SMB environments; has threat intelligence in alert mode only.
+  
+- **Standard SKU**: Up to 30 Gbps; enterprise environments; L3–L7 filtering, DNS proxy, web categories, and threat intelligence.
+  
+- **Premium SKU**: Up to 100 Gbps; regulated/sensitive environments (healthcare, payment); adds TLS inspection, IDPS, full URL filtering, and PCI DSS compliance.
 
 
 
 
 ## What are Azure Firewall rules?
 
- An Azure Firewall denies all traffic by default, until rules are manually configured to allow traffic. Rules are organized inside Rule Collections which are contained in Rule Collection Groups. In the Azure Firewall, you can configure NAT rules, network rules, and applications rules.
+ An Azure Firewall denies all traffic by default, until rules are manually configured to allow traffic. Rules are organized inside Rule Collections that are contained in Rule Collection Groups. In the Azure Firewall, you can configure NAT rules, network rules, and applications rules.
 
 | Rule type	| Description |
 | --- | --- |

learn-pr/wwl-azure/design-implement-network-security-monitoring/includes/8-secure-networks-with-azure-firewall-manager.md

@@ -14,15 +14,22 @@ Firewall Manager can provide security management for secured virtual hubs and hu
 
 - **Hub Virtual Network**. A standard Azure virtual network that you create and manage. When you associate firewall policies with this type of hub, you're creating a hub virtual network. This architecture's underlying resource is a virtual network.
 
-### Azure Firewall Manager features
+### Azure Firewall Manager capabilities
 
-If your organization has multiple Azure Firewall instances, you benefit from centralizing these configurations. Firewall Manager enables you to:
+Azure Firewall Manager provides six key capability areas:
 
-- Span multiple Azure subscriptions.
+-	**Central deployment and configuration**. Manage Azure Firewall deployment and policies across multiple subscriptions and regions.
+  
+-	**Hierarchical policies**.  Create global policies authored by central IT with locally authored overrides.
+  
+-	**Security partner provider integration**.  Route Internet-bound VNet and branch traffic through Zscaler, Check Point, or iboss while Azure Firewall handles private traffic in the same hub.
+  
+-	**Centralized route management**.  Automatically route spoke traffic to secured hubs without manually configuring user-defined routes.
+  
+-	**DDoS protection plan management**.  Associate virtual networks with a DDoS plan directly from Firewall Manager.
+  
+-	**WAF policy management**.  Centrally create, view, and associate WAF policies to Front Door and Application Gateway across subscriptions.
 
-- Span different Azure regions.
-
-- Implement hub and spoke architectures to provide for traffic governance and protection.
 
 ### Azure Firewall Manager decision criteria
 
@@ -36,4 +43,4 @@ Administrators who protect multiple Azure virtual networks use rules to control
 
 
 > [!TIP]
-> Learn more about Azure Firewall in the [Introduction to Azure Firewall Manager](/training/modules/introduction-azure-firewall/) module.
+> Learn more about Azure Firewall in the [Introduction to Azure Firewall Manager](/training/modules/introduction-azure-firewall/) module.

learn-pr/wwl-azure/design-implement-network-security-monitoring/index.yml

@@ -13,7 +13,7 @@ metadata:
   ms.custom:
   - N/A
   ms.service: azure
-  ai-usage: human-only
+  ai-usage: ai-assisted
 title: Design and implement network security
 summary: You learn to design and implement network security solutions such as Azure DDoS, Network Security Groups, Azure Firewall, and Web Application Firewall.
 abstract: |