Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

An enterprise network consists of three Azure virtual networks in the East US region:

* VNet-Hub with the address space 10.100.0.0/1610.100.0.0/16, which contains a virtual network gateway.
* VNet-Spoke1 with the address space 10.101.0.0/1610.101.0.0/16, which contains a subnet hosting `VM-1`.
* VNet-Spoke2 with the address space 10.102.0.0/1610.102.0.0/16, which contains a subnet hosting `VM-2`.

You establish bidirectional peering links between `VNet-Hub` and `VNet-Spoke1`, and between `VNet-Hub` and `VNet-Spoke2`.

You need to ensure that `VM-1` can communicate with your on-premises network using the gateway in `VNet-Hub`. The solution must minimize administrative effort and ensure `VM-2` cannot access the on-premises network.

What configuration settings should you apply to the virtual network peering links?

  1. Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit, and configure the peering link from VNet-Spoke1 to VNet-Hub to use the remote virtual network's gateway.Answer
  2. B
    Configure the peering link from VNet-Hub to VNet-Spoke1 to use the remote virtual network's gateway, and configure the peering link from VNet-Spoke1 to VNet-Hub to allow gateway transit.
  3. C
    Configure the peering links between VNet-Hub and both spokes to enable Allow forwarded traffic, and create a route table in VNet-Spoke1 with a next hop type of Virtual Appliance.
  4. D
    Enable Allow gateway transit and Use remote virtual network's gateway globally on all peering links, as gateway transit settings are automatically applied transitively to all peered networks.

Answer

Configure the peering link from VNet-Hub to VNet-Spoke1 to allow gateway transit, and configure the peering link from VNet-Spoke1 to VNet-Hub to use the remote virtual network's gateway.
The correct answer properly configures gateway transit: the hub network (VNet-Hub) hosting the VPN gateway must have 'Allow gateway transit' enabled, while the spoke network (VNet-Spoke1) consuming the gateway must have 'Use remote virtual network's gateway' enabled. This allows VM-1 to route traffic to the on-premises network through VNet-Hub, while VM-2 remains unaffected since its peering link settings are not modified.

Step-by-Step Solution

1
Identify the location of the Virtual Network Gateway and the VM that needs connectivity.
The Virtual Network Gateway is in VNet-Hub. VM-1 is in VNet-Spoke1. Connectivity is needed between VM-1 and on-premises via VNet-Hub.
This establishes which network is the transit provider (VNet-Hub) and which is the transit consumer (VNet-Spoke1).
2
Determine the necessary peering settings on the gateway hosting side (VNet-Hub).
Enable 'Allow gateway transit' on the peering link from VNet-Hub to VNet-Spoke1.
This configuration permits VNet-Spoke1 to leverage the gateway residing in VNet-Hub.
3
Determine the necessary peering settings on the spoke side (VNet-Spoke1).
Enable 'Use remote virtual network's gateway' (or 'Use remote gateways') on the peering link from VNet-Spoke1 to VNet-Hub.
This allows resources in VNet-Spoke1 to route their traffic to on-premises via the remote gateway.

Key Concept

Gateway transit in virtual network peering allows peered virtual networks to share a VPN or ExpressRoute gateway for on-premises connectivity.
Estimated Time:1m 30s
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic