Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

Your company has three virtual networks named VNet-East (10.51.0.0/1610.51.0.0/16), VNet-Central (10.52.0.0/1610.52.0.0/16), and VNet-West (10.53.0.0/1610.53.0.0/16). Virtual machines are deployed in subnets within each of the three virtual networks. VNet-Central contains a virtual network gateway. You establish virtual network peering between VNet-East and VNet-Central, and between VNet-West and VNet-Central. The peerings are configured to allow gateway transit on VNet-Central and use remote gateways on VNet-East and VNet-West. A junior administrator reports that the virtual machines in VNet-East cannot communicate with the virtual machines in VNet-West. You need to allow virtual machines in VNet-East to communicate directly with virtual machines in VNet-West without routing through any virtual appliances or gateways. What should you do?

  1. A
    Add a custom route to VNet-East and VNet-West that uses the VNet-Central gateway as the next hop.
  2. Create a virtual network peering connection between VNet-East and VNet-West.Answer
  3. C
    Enable 'Allow forwarded traffic' on the peering connections between VNet-Central and the other two virtual networks.
  4. D
    Configure a new virtual network gateway in both VNet-East and VNet-West.

Answer

Create a virtual network peering connection between VNet-East and VNet-West.
The correct action is to create a virtual network peering connection directly between VNet-East and VNet-West. Because Azure virtual network peering is non-transitive, VNet-East and VNet-West cannot communicate through VNet-Central, even if both are peered to it. Since the scenario specifies that no virtual appliances should be used for routing, establishing a direct peering connection is the only valid way to allow communication.

Step-by-Step Solution

1
Analyze the virtual network architecture and current configuration.
VNet-East and VNet-West are both peered to VNet-Central (a hub-and-spoke topology), but they are not peered directly to each other.
Understanding the current topology helps identify the lack of direct or transit routing pathways.
2
Evaluate the transitivity properties of Azure Virtual Network Peering.
By default, Azure virtual network peering is non-transitive. Traffic from VNet-East cannot transit through VNet-Central to reach VNet-West, even with gateway transit settings enabled, unless a transit routing appliance (like a Network Virtual Appliance) is deployed.
This identifies why the current configuration fails to allow communication between the two spokes.
3
Determine the solution that avoids virtual appliances or gateways.
Creating a direct virtual network peering connection between VNet-East and VNet-West establishes direct VM-to-VM communication without traversing the hub or using gateways.
This satisfies the requirement to enable direct communication without using virtual appliances or gateways.

Key Concept

Azure Virtual Network Peering is non-transitive by default. To establish communication between two spoke virtual networks without a transit routing appliance in the hub, a direct virtual network peering connection must be configured between them.
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic