Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

An organization deploys a hub-and-spoke network topology in Azure containing three virtual networks:

* `VNet-Hub` (10.10.0.0/1610.10.0.0/16) containing a subnet with `VM-Hub` deployed.
* `VNet-SpokeA` (10.20.0.0/1610.20.0.0/16) containing a subnet with `VM-SpokeA` deployed.
* `VNet-SpokeB` (10.30.0.0/1610.30.0.0/16) containing a subnet with `VM-SpokeB` deployed.

Virtual network peering is configured between `VNet-Hub` and `VNet-SpokeA`, and between `VNet-Hub` and `VNet-SpokeB`. The settings 'Allow forwarded traffic', 'Use remote gateways', and 'Allow gateway transit' are currently left at their default values of disabled.

An administrator reports that `VM-SpokeA` cannot communicate with `VM-SpokeB` over the peered networks.

Which of the following actions should the administrator take to establish direct network connectivity between `VM-SpokeA` and `VM-SpokeB` with the minimum administrative effort?

  1. Create a virtual network peering directly between VNet-SpokeA and VNet-SpokeB.Answer
  2. B
    Enable 'Allow gateway transit' on the peering link from VNet-Hub to VNet-SpokeA, and enable 'Use remote gateways' on the peering link from VNet-SpokeB to VNet-Hub.
  3. C
    Enable 'Allow forwarded traffic' on the peering links in VNet-Hub, and configure a user-defined route (UDR) in each spoke pointing to VM-Hub as the next hop.
  4. D
    Enable 'Allow gateway transit' on both peering connections in VNet-Hub to enable automatic transit routing.

Answer

Create a virtual network peering directly between VNet-SpokeA and VNet-SpokeB.
The correct option is to create a direct virtual network peering between the two spokes. Because Azure virtual network peering is non-transitive, traffic cannot transit from one spoke to another via the hub without a router or gateway. A direct peering link is the most efficient solution because it requires no additional infrastructure or route tables.

Step-by-Step Solution

1
Analyze the existing topology and identify the connectivity gap.
VM-SpokeA in VNet-SpokeA cannot reach VM-SpokeB in VNet-SpokeB because virtual network peering is non-transitive by default.
Before applying a fix, the administrator must confirm that traffic between two spoke networks cannot transit through a peered hub without an active routing mechanism (like a gateway or network virtual appliance).
2
Determine the path of least resistance to connect the two spoke VNets directly.
Since both spokes are in the same or peered regions, creating a direct virtual network peering link between VNet-SpokeA and VNet-SpokeB is the simplest, most performant solution.
Direct peering avoids the need to deploy and manage a hub routing appliance (NVA/Firewall) or write complex routing tables (UDRs).
3
Configure the bidirectional peering links between the spokes.
Establish peering from VNet-SpokeA to VNet-SpokeB, and VNet-SpokeB to VNet-SpokeA.
Virtual network peering must be configured in both directions to establish complete data plane connectivity.

Key Concept

Azure Virtual Network Peering is non-transitive. Spoke-to-spoke communication requires either a direct peering link between spokes or an intermediate routing appliance (NVA) in the hub coupled with custom route tables (UDRs).
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic