A fully managed, highly available network firewall as a service that inspects and filters traffic between VNets, subnets, and the internet using network, application (FQDN), and NAT rules. It is typically deployed in the hub VNet.
On AZ-305 it sits in the hub of a hub-and-spoke topology to centralize outbound filtering for all spokes. It differs from an NSG (IP/port rules at the subnet/NIC level): Azure Firewall supports FQDN-based filtering and is stateful across the whole network.
Azure Firewall is a concept that can show up on the exam. Check the full guide to see it in context.