An administrator manages three Azure virtual networks in the North Europe region: * `VNet-… — Microsoft Azure Administrator (AZ-104)

An administrator manages three Azure virtual networks in the North Europe region:

* `VNet-A` with an address space of $10.10.0.0/16$ contains a virtual machine named `VM-A` in a subnet named `Subnet-A` ( $10.10.1.0/24$ ).
* `VNet-B` with an address space of $10.20.0.0/16$ contains a virtual machine named `VM-B` in a subnet named `Subnet-B` ( $10.20.1.0/24$ ).
* `VNet-C` with an address space of $10.30.0.0/16$ contains a virtual machine named `VM-C` in a subnet named `Subnet-C` ( $10.30.1.0/24$ ).

The administrator establishes the following peering connections using default settings:

* `Peering-AB` connects `VNet-A` to `VNet-B`.
* `Peering-BC` connects `VNet-B` to `VNet-C`.

No virtual network gateways or user-defined routes are deployed. `VM-A` can successfully communicate with `VM-B`, but cannot communicate with `VM-C`.

What should the administrator do to allow `VM-A` to communicate with `VM-C`?

Create a direct virtual network peering connection between `VNet-A` and `VNet-C`.Answer
B
Enable 'Allow forwarded traffic' on both `Peering-AB` and `Peering-BC`.
C
Enable 'Allow gateway transit' on `Peering-AB` and configure 'Use remote gateways' on `Peering-BC`.
D
Create and associate a route table with `Subnet-A` and `Subnet-C` that contains a route to the remote network with a next hop type of Virtual Network.

Answer

Create a direct virtual network peering connection between `VNet-A` and `VNet-C`.

The correct answer is correct because virtual network peering in Azure is non-transitive. This means that two virtual networks cannot communicate through a transit network unless a Network Virtual Appliance (NVA) or a Virtual Network Gateway is configured to route the traffic. Since no gateways or NVAs are deployed in this scenario, the only way to allow direct communication between `VM-A` and `VM-C` is to establish a direct peering connection between `VNet-A` and `VNet-C`.

Step-by-Step Solution

Analyze the virtual network peering topology.

The topology is a linear chain: `VNet-A` is peered to `VNet-B`, and `VNet-B` is peered to `VNet-C`.

Understanding the layout helps determine why communication fails between the end networks.

Evaluate Azure Virtual Network Peering transit behavior.

Azure Virtual Network Peering is non-transitive. Traffic from `VNet-A` cannot transit through `VNet-B` to reach `VNet-C` by default.

This explains why `VM-A` cannot talk to `VM-C` despite both being peered to `VNet-B`.

Determine the solution with minimal complexity and no additional routing appliances.

Establishing a direct peering link between `VNet-A` and `VNet-C` will enable communication.

Direct peering connects the two networks over the Microsoft backbone without requiring NVAs or gateways.

Key Concept

Azure Virtual Network Peering is non-transitive by default.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic