An organization has an Azure virtual network named VNet-Prod (10.10.0.0/16) with three sub… — Microsoft Azure Administrator (AZ-104)

An organization has an Azure virtual network named VNet-Prod ( $10.10.0.0/16$ ) with three subnets: Web-Subnet ( $10.10.1.0/24$ ), App-Subnet ( $10.10.2.0/24$ ), and Sec-Subnet ( $10.10.3.0/24$ ). A Network Virtual Appliance (NVA) named NVA-Sec ( $10.10.3.10$ ) is deployed in Sec-Subnet. A route table named RT-Web is associated with Web-Subnet. Currently, RT-Web contains the following user-defined routes:

- Route A: Destination $10.10.2.0/24$ , Next hop type: Virtual appliance, Next hop IP address: $10.10.3.10$
- Route B: Destination $10.10.2.0/25$ , Next hop type: Virtual network
- Route C: Destination $0.0.0.0/0$ , Next hop type: Internet

You notice that traffic from Web-Subnet destined for servers in App-Subnet with IP addresses from $10.10.2.1$ to $10.10.2.50$ is bypassing NVA-Sec and communicating directly. You need to ensure that all traffic from Web-Subnet to App-Subnet is routed through NVA-Sec and successfully forwarded by the appliance. Which two actions should you perform? (Select two.)

Delete Route B from the RT-Web route table.Answer
Enable IP forwarding on the virtual network interface of NVA-Sec.Answer
C
Modify Route B to set the next hop type to Virtual Network Gateway.
D
Associate the RT-Web route table with App-Subnet.

Answer

Delete Route B from the RT-Web route table and enable IP forwarding on the virtual network interface of NVA-Sec.

Deleting Route B removes the more specific

/25

route which was matching the

10.10.2.1

10.10.2.50

destination range and routing it directly. Once deleted, Route A (

10.10.2.0/24

) becomes the longest prefix match, sending all App-Subnet traffic to the NVA's IP. Additionally, IP forwarding must be enabled on the NVA's virtual network interface so that Azure does not drop transit packets.

Step-by-Step Solution

Analyze why traffic to

10.10.2.1

through

10.10.2.50

bypasses the NVA.

Identify that

10.10.2.1

through

10.10.2.50

fall within the range of Route B (

10.10.2.0/25

). Due to Longest Prefix Match (LPM), Route B (

/25

prefix) takes precedence over Route A (

/24

prefix). Therefore, traffic to these IPs bypasses the NVA and goes directly via the Virtual Network.

Azure route selection logic always selects the route with the longest matching prefix.

Remove the bypassing route to force all traffic to Route A.

Delete Route B from the RT-Web route table. This leaves Route A (

10.10.2.0/24

) as the longest matching route for all destinations in App-Subnet.

Without the

/25

route, the

/24

user-defined route is matched, redirecting all App-Subnet traffic to the NVA.

Configure the NVA to allow routing of transit traffic.

Enable IP forwarding on the virtual network interface of NVA-Sec.

By default, Azure drops packets not addressed to the receiving network interface. Enabling IP forwarding allows the NVA to route transit traffic.

Key Concept

Azure routes traffic using the Longest Prefix Match (LPM) rule. User-defined routes override system routes of the same prefix length, but a more specific route (longer prefix) always wins. Additionally, virtual network interfaces in Azure drop packets not addressed to themselves unless IP forwarding is explicitly enabled.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics