An administrator is configuring routing for an Azure virtual network named `VNet-Ecom` (10… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring routing for an Azure virtual network named `VNet-Ecom` ( $10.80.0.0/16$ ). The virtual network contains three subnets: `Web-Subnet` ( $10.80.1.0/24$ ), `Database-Subnet` ( $10.80.2.0/24$ ), and `DMZ-Subnet` ( $10.80.10.0/24$ ). A Network Virtual Appliance (NVA) is deployed in `DMZ-Subnet` with the private IP address $10.80.10.4$ and has IP forwarding enabled. You create a custom route table named `RT-Web` and associate it with `Web-Subnet`. You need to ensure that all traffic from `Web-Subnet` to `Database-Subnet` is inspected by the NVA. Which route configuration should you add to `RT-Web`?

A
Address prefix: $10.80.2.0/24$ , Next hop type: Virtual network gateway, Next hop address: $10.80.10.4$
Address prefix: $10.80.2.0/24$ , Next hop type: Virtual appliance, Next hop address: $10.80.10.4$ Answer
C
Address prefix: $10.80.2.0/24$ , Next hop type: Virtual appliance, Next hop address: $10.80.2.4$
D
Address prefix: $10.80.0.0/16$ , Next hop type: Virtual appliance, Next hop address: $10.80.10.4$

Answer

Address prefix:

10.80.2.0/24

, Next hop type: Virtual appliance, Next hop address:

10.80.10.4

To route traffic from one subnet to another through a firewall or other virtual appliance, you must define a route with the destination prefix of the target subnet (in this case, the database subnet prefix

10.80.2.0/24

), specify the next hop type as 'Virtual appliance', and provide the private IP address of the virtual appliance (

10.80.10.4

). Since the user-defined route has a more specific prefix (

10.80.2.0/24

) than the default system route for the VNet (

10.80.0.0/16

), Azure will select the user-defined route based on the longest prefix match rule, forwarding the traffic to the virtual appliance.

Step-by-Step Solution

Identify the target destination subnet and its address prefix.

The target destination is Database-Subnet, which has the address prefix

10.80.2.0/24

UDRs require a destination address prefix to match and route traffic to the correct destination.

Determine the correct next hop type and IP address for the Network Virtual Appliance (NVA).

Next hop type must be 'Virtual appliance', and the next hop IP address must be the NVA's interface IP (

10.80.10.4

An NVA in Azure is represented by the 'Virtual appliance' next hop type, and its private IP must be reachable within the VNet.

Select the route prefix that overrides the system route without causing routing loops.

Use the destination prefix

10.80.2.0/24

rather than the entire VNet prefix

10.80.0.0/16

Using

10.80.2.0/24

targets only database traffic, avoiding a routing loop that would occur if the entire VNet range (which contains the NVA itself) were routed to the NVA.

Key Concept

Configuring User-Defined Routes (UDRs) to direct traffic through a Network Virtual Appliance (NVA) requires specifying a 'Virtual appliance' next hop type with the NVA's private IP, using the most specific destination IP prefix to avoid routing loops.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics