An enterprise Azure environment is configured with a virtual network named `VNet1` (10.0.0… — Microsoft Azure Administrator (AZ-104)

An enterprise Azure environment is configured with a virtual network named `VNet1` ( $10.0.0.0/16$ ) that contains the following subnets:
- `Subnet-Web` ( $10.0.1.0/24$ )
- `Subnet-App` ( $10.0.2.0/24$ )
- `Subnet-DB` ( $10.0.3.0/24$ )
- `Subnet-Sec` ( $10.0.10.0/24$ )

A Network Virtual Appliance (NVA) named `Sec-NVA` is deployed in `Subnet-Sec` with the private IP address $10.0.10.4$ .

You need to configure routing for `Subnet-Web` to meet the following requirements:
1. All traffic sent to `Subnet-App` must be routed through the NVA.
2. All traffic sent to the specific IP range $10.0.2.128/26$ within `Subnet-App` must bypass the NVA and route directly.
3. All other traffic to `VNet1` subnets must route directly via default routing.
4. All outbound traffic to the Internet must route through the NVA.

Which combination of route entries and network interface configurations on `Sec-NVA` will meet these requirements?

Configure three routes in the route table associated with `Subnet-Web`:
- Destination: $0.0.0.0/0$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.0/24$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.128/26$ , Next hop type: Virtual network
And enable IP forwarding on the network interface of `Sec-NVA`.Answer
B
Configure three routes in the route table associated with `Subnet-Web`:
- Destination: $0.0.0.0/0$ , Next hop type: Virtual Network Gateway, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.0/24$ , Next hop type: Virtual Network Gateway, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.128/26$ , Next hop type: Virtual network
And enable IP forwarding on the network interface of `Sec-NVA`.
C
Configure three routes in the route table associated with `Subnet-Web`:
- Destination: $0.0.0.0/0$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.0/24$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.128/26$ , Next hop type: Virtual network
And disable IP forwarding on the network interface of `Sec-NVA`.
D
Configure three routes in the route table associated with `Subnet-Web`:
- Destination: $0.0.0.0/0$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.0/24$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
- Destination: $10.0.2.128/26$ , Next hop type: Virtual appliance, Next hop IP: $10.0.10.4$
And enable IP forwarding on the network interface of `Sec-NVA`.

Answer

The configuration that sets

0.0.0.0/0

and

10.0.2.0/24

to route to the Virtual appliance at

10.0.10.4

, sets

10.0.2.128/26

to route to the Virtual network, and enables IP forwarding on the network interface of the NVA.

The correct option sets the route for

10.0.2.0/24

to the Virtual appliance (

10.0.10.4

), overrides it for the specific sub-range

10.0.2.128/26

by setting the next hop to Virtual network (exploiting the Longest Prefix Match rule), routes the Internet traffic (

0.0.0.0/0

) to the NVA, and enables IP forwarding on the NVA's network interface to authorize transit routing.

Step-by-Step Solution

Determine how to route the general subnet traffic and the bypass subnet range.

Create a route for

10.0.2.0/24

with the next hop set to the NVA's IP (

10.0.10.4

). To allow the subset range

10.0.2.128/26

to bypass the NVA, define a more specific route pointing to 'Virtual network' as the next hop.

Azure routing uses the Longest Prefix Match (LPM) rule. A route with a /26 prefix is more specific than a /24 prefix. Therefore, traffic for

10.0.2.128/26

will match the /26 route and bypass the NVA, while all other traffic in

10.0.2.0/24

matches the /24 route and goes to the NVA.

Identify the correct next hop type for routing traffic through the firewall appliance.

Select 'Virtual appliance' as the next hop type and specify the NVA private IP address (

10.0.10.4

Azure requires the 'Virtual appliance' next hop type when routing traffic to custom firewalls or routing NVAs.

Ensure the NVA can forward traffic not destined for its own IP address.

Enable IP forwarding on the network interface (NIC) associated with `Sec-NVA` in Azure.

By default, Azure VMs drop network traffic that does not originate from or terminate at their own private IP address. Enabling IP forwarding allows the NVA to act as a transit router.

Key Concept

Azure User-Defined Routes (UDR) prioritize custom routes over system routes. When multiple routes match a destination, the Longest Prefix Match (LPM) rule dictates the path. Network Virtual Appliances require IP forwarding enabled on their network interface to forward transit traffic.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics