Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

An administrator configures three Azure virtual networks named `VNet1` (10.1.0.0/1610.1.0.0/16), `VNet2` (10.2.0.0/1610.2.0.0/16), and `VNet3` (10.3.0.0/1610.3.0.0/16). Virtual machines are deployed in the subnets of each virtual network to run active workloads. Peering is configured between `VNet1` and `VNet2`, and between `VNet2` and `VNet3`. The peering links have 'Allow forwarded traffic' enabled on both sides, but 'Allow gateway transit' and 'Use remote gateways' are disabled. No user-defined routes (UDRs) or virtual network gateways exist in any of the networks. Which of the following describes the network connectivity between the virtual machines?

  1. Virtual machines in `VNet1` can communicate with virtual machines in `VNet2`, and virtual machines in `VNet2` can communicate with virtual machines in `VNet3`, but virtual machines in `VNet1` and `VNet3` cannot communicate.Answer
  2. B
    Virtual machines in `VNet1`, `VNet2`, and `VNet3` can all communicate with each other because 'Allow forwarded traffic' is enabled on both peering connections.
  3. C
    Virtual machines in `VNet1` can communicate with virtual machines in `VNet3` only if the peering connections are configured to enable 'Use remote gateways'.
  4. D
    Virtual machines in `VNet1` and `VNet3` can communicate only if you create a shared Private DNS Zone and link it to both virtual networks.

Answer

Virtual machines in `VNet1` can communicate with virtual machines in `VNet2`, and virtual machines in `VNet2` can communicate with virtual machines in `VNet3`, but virtual machines in `VNet1` and `VNet3` cannot communicate.
The correct answer is correct because Azure Virtual Network Peering is strictly non-transitive. Direct peering connections allow virtual machines in VNet1 to talk to VNet2, and virtual machines in VNet2 to talk to VNet3, but do not allow traffic to flow from VNet1 through VNet2 to VNet3.

Step-by-Step Solution

1
Analyze the virtual network peering topology.
Peering is configured between VNet1 and VNet2, and between VNet2 and VNet3. No direct peering exists between VNet1 and VNet3.
This establishes which direct network paths are configured.
2
Evaluate the transitivity rule of Azure Virtual Network Peering.
Virtual network peering is non-transitive by default. Traffic from VNet1 cannot transit through VNet2 to reach VNet3.
This determines if indirect communication is possible through peered networks.
3
Assess the configuration settings ('Allow forwarded traffic', 'Allow gateway transit', and 'Use remote gateways').
Since no gateway or virtual appliance is present, enabling 'Allow forwarded traffic' has no effect on transitivity, and gateway transit options cannot be used.
This rules out advanced transit features and confirms that VNet1 and VNet3 remain disconnected.

Key Concept

Azure Virtual Network Peering is non-transitive, meaning that traffic cannot transit through a peered virtual network to reach another peered network unless transit routing (via Network Virtual Appliances or Virtual Network Gateways) is explicitly configured.
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic