Examkin

Question

Difficulty: MediumConfigure Azure Firewall

You have an Azure virtual network named `Hub-VNet` that contains an Azure Firewall. The firewall is configured with a private IP address of 10.10.1.410.10.1.4. You also have a peered virtual network named `Spoke-VNet` that contains a subnet named `Subnet-App`. You associate a new route table named `RouteTable-Spoke` with `Subnet-App`. You need to ensure that all outbound internet traffic from `Subnet-App` is routed through the Azure Firewall in `Hub-VNet`.

Which route should you add to `RouteTable-Spoke`?

  1. A route with a destination address prefix of 0.0.0.0/00.0.0.0/0, a next hop type of Virtual appliance, and a next hop IP address of 10.10.1.410.10.1.4.Answer
  2. B
    A route with a destination address prefix of 0.0.0.0/00.0.0.0/0, a next hop type of Virtual network gateway, and a next hop IP address of 10.10.1.410.10.1.4.
  3. C
    A route with a destination address prefix of 0.0.0.0/00.0.0.0/0 and a next hop type of Internet.
  4. D
    No custom route; instead, enable the Use Remote Gateways option on the peering connection from `Spoke-VNet` to `Hub-VNet`.

Answer

A route with a destination address prefix of 0.0.0.0/00.0.0.0/0, a next hop type of Virtual appliance, and a next hop IP address of 10.10.1.410.10.1.4.
To route all outbound internet traffic from a spoke subnet to an Azure Firewall in a hub VNet, you must associate a route table with the spoke subnet and add a default route (0.0.0.0/00.0.0.0/0). Because Azure Firewall acts as a network virtual appliance, the next hop type must be configured as 'Virtual appliance' and the next hop IP address must be the private IP address of the firewall (10.10.1.410.10.1.4).

Step-by-Step Solution

1
Identify the target destination for the route.
Since the requirement is to route all outbound internet traffic, the destination address prefix must be set to 0.0.0.0/00.0.0.0/0, which matches all IPv4 addresses not covered by more specific routes.
The system needs to know which traffic is subject to this routing rule.
2
Select the correct next hop type for Azure Firewall.
The next hop type must be set to 'Virtual appliance'.
Azure Firewall behaves as a network virtual appliance (NVA) inside the virtual network hierarchy.
3
Specify the next hop address.
The next hop address must be the private IP address of the Azure Firewall (10.10.1.410.10.1.4).
This directs the virtual network's routing engine to forward matching packets directly to the firewall's internal interface.

Key Concept

Configuring custom routing (User-Defined Routes) to direct traffic through Azure Firewall.
Estimated Time:1m 30s
Rate this question

Topics

Configure Azure Firewall

More questions from this topic