Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

You manage three Azure virtual networks in the West US region:
* `VNet-Transit` (172.20.0.0/16172.20.0.0/16) contains a Virtual Network Gateway configured for an ExpressRoute connection to your on-premises datacenter.
* `VNet-App` (172.21.0.0/16172.21.0.0/16) contains virtual machines running web applications.
* `VNet-Database` (172.22.0.0/16172.22.0.0/16) contains virtual machines running database instances.

You configure virtual network peering between `VNet-Transit` and `VNet-App`, and between `VNet-Transit` and `VNet-Database`.

You need to ensure that the virtual machines in both `VNet-App` and `VNet-Database` can connect to the on-premises datacenter through the Virtual Network Gateway in `VNet-Transit`.

Which configuration must you apply to the peering links?

  1. Configure the peering links from `VNet-Transit` to enable Allow gateway transit, and configure the peering links from `VNet-App` and `VNet-Database` to enable Use remote gateways.Answer
  2. B
    Configure the peering links from `VNet-Transit` to enable Use remote gateways, and configure the peering links from `VNet-App` and `VNet-Database` to enable Allow gateway transit.
  3. C
    Configure the peering links from `VNet-Transit` to enable Allow forwarded traffic, and configure the peering links from `VNet-App` and `VNet-Database` to enable Allow forwarded traffic.
  4. D
    Deploy a Virtual Network Gateway in both `VNet-App` and `VNet-Database`, and configure the peering links to enable Allow gateway transit on all connections.

Answer

Configure the peering links from `VNet-Transit` to enable Allow gateway transit, and configure the peering links from `VNet-App` and `VNet-Database` to enable Use remote gateways.
To allow spoke virtual networks (`VNet-App` and `VNet-Database`) to use the VPN or ExpressRoute gateway in a hub virtual network (`VNet-Transit`), you must enable gateway transit. This is done by configuring Allow gateway transit on the peering link from the hub virtual network (`VNet-Transit`) to the spokes and configuring Use remote gateways (or 'Use this virtual network's gateway or Route Server') on the peering links from the spoke virtual networks (`VNet-App` and `VNet-Database`) to the hub.

Step-by-Step Solution

1
Identify the hub-and-spoke relationship between the virtual networks.
`VNet-Transit` acts as the hub since it hosts the Virtual Network Gateway, while `VNet-App` and `VNet-Database` act as spokes.
Determining the network roles identifies which network must share its gateway resources.
2
Enable the sharing capability on the hub virtual network.
Enable Allow gateway transit on the peering links originating from `VNet-Transit`.
This configuration permits the hub to route spoke traffic through its local gateway.
3
Configure the spoke networks to utilize the shared resource.
Enable Use remote gateways on the peering links originating from both `VNet-App` and `VNet-Database`.
This instructs the spokes to route external traffic to the remote gateway located in the peered hub network.

Key Concept

Gateway Transit in Virtual Network Peering
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic