An organization deploys a three-tier architecture in a single Azure virtual network named … — Microsoft Azure Administrator (AZ-104)

An organization deploys a three-tier architecture in a single Azure virtual network named `VNet-Secure` ( $10.40.0.0/16$ ). The virtual network contains the following subnets:

* `Subnet-Web` ( $10.40.1.0/24$ )
* `Subnet-DB` ( $10.40.2.0/24$ )
* `Subnet-DMZ` ( $10.40.3.0/24$ )

A third-party security firewall operates as a Network Virtual Appliance (NVA) in `Subnet-DMZ` with the private IP address $10.40.3.10$ . By default, Azure system routes allow direct IP communication between all subnets.

You must configure the environment to force all outbound traffic from `Subnet-Web` destined for `Subnet-DB` to traverse the firewall NVA.

Which two configurations should you implement? (Select two.)

Associate a route table with `Subnet-Web` that contains a user-defined route for $10.40.2.0/24$ with a next hop type of Virtual appliance and a next hop IP address of $10.40.3.10$ .Answer
Enable IP forwarding on the Azure network interface of the firewall Network Virtual Appliance.Answer
C
Associate a route table with `Subnet-Web` that contains a user-defined route for $10.40.2.0/24$ with a next hop type of Virtual Network Gateway and a next hop IP address of $10.40.3.10$ .
D
Enable IP forwarding on the Azure network interfaces of all virtual machines residing in `Subnet-Web`.
E
Associate a route table with `Subnet-DMZ` that contains a user-defined route for $10.40.1.0/24$ with a next hop type of Virtual Network.

Answer

To force traffic from the Web subnet to the database subnet through the firewall, you must create a route table with a route targeting the database subnet (

10.40.2.0/24

) using the Virtual appliance next hop type with the NVA's IP address (

10.40.3.10

), associate this route table with the Web subnet, and enable IP forwarding on the NVA's network interface.

To successfully route traffic through an NVA, a user-defined route must be configured and associated with the source subnet where traffic originates. The route must specify the destination prefix (in this case, the database subnet

10.40.2.0/24

), set the next hop type to Virtual appliance, and specify the NVA's private IP address (

10.40.3.10

). In addition, the NVA's network interface in Azure must have IP forwarding enabled so that it can forward traffic that is not natively addressed to it.

Step-by-Step Solution

Configure the User-Defined Route (UDR) for the source subnet.

A route table is created and associated with the Web subnet containing a route to the database subnet (

10.40.2.0/24

) via the NVA's IP address (

10.40.3.10

) using the 'Virtual appliance' next hop type.

This overrides the default system route (

10.40.0.0/16

-> Virtual Network) for traffic heading from the Web subnet to the database subnet.

Enable IP forwarding on the NVA's network interface (NIC).

The network interface of the firewall NVA is configured to allow transit traffic.

By default, Azure drops traffic sent to a virtual machine's NIC if the destination IP does not match the IP configured on the NIC. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Key Concept

Routing traffic through a Network Virtual Appliance (NVA) requires configuring a user-defined route with the 'Virtual appliance' next hop type and enabling IP forwarding on the NVA's network interface.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics