Your company has an Azure environment with a virtual network named `VNet-Corp` (10.150.0.0… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure environment with a virtual network named `VNet-Corp` ( $10.150.0.0/16$ ). `VNet-Corp` contains three subnets:

* `Subnet-Web` ( $10.150.1.0/24$ )
* `Subnet-DMZ` ( $10.150.2.0/24$ )
* `Subnet-DB` ( $10.150.3.0/24$ )

A virtual machine named `NVA1` is deployed in `Subnet-DMZ` to act as a firewall. `NVA1` has a single network interface with the private IP address $10.150.2.10$ . You must ensure that all traffic from `Subnet-Web` destined for `Subnet-DB` is routed through `NVA1` for security inspection, while ensuring other subnet traffic is unaffected by this custom routing configuration.

Which of the following actions should you perform? (Select TWO choices.)

Configure a route table with a route for destination $10.150.3.0/24$ , setting the next hop type to Virtual appliance and the next hop IP address to $10.150.2.10$ , and associate this route table with `Subnet-Web`.Answer
Enable IP forwarding on the network interface attached to the `NVA1` virtual machine.Answer
C
Configure a route table with a route for destination $10.150.3.0/24$ , setting the next hop type to Virtual Network Gateway and the next hop IP address to $10.150.2.10$ , and associate this route table with `Subnet-Web`.
D
Configure a route table with a route for destination $10.150.3.0/24$ , setting the next hop type to Virtual appliance and the next hop IP address to $10.150.2.10$ , and associate this route table with `Subnet-DB`.

Answer

Configure a route table with a route for destination

10.150.3.0/24

, setting the next hop type to Virtual appliance and the next hop IP address to

10.150.2.10

, and associate this route table with `Subnet-Web`. Additionally, enable IP forwarding on the network interface attached to the `NVA1` virtual machine.

To successfully route traffic from the Web subnet to the database subnet through the firewall virtual machine, you must create a user-defined route table with a route pointing to the database subnet prefix (

10.150.3.0/24

) with a next hop type of Virtual appliance and the private IP address of the firewall (

10.150.2.10

). This route table must then be associated with the source subnet (`Subnet-Web`). Additionally, you must enable IP forwarding on the network interface of the firewall VM in Azure to prevent Azure from discarding packets not destined directly for the firewall's IP address.

Step-by-Step Solution

Define a custom routing rule for traffic going to the database subnet.

A route table is created containing a route for

10.150.3.0/24

with the next hop type set to Virtual appliance and the next hop IP address set to

10.150.2.10

This configuration overrides the default system route (

10.150.0.0/16

-> Virtual Network) for traffic destined to the database subnet by using the Longest Prefix Match (LPM) rule, ensuring it is redirected to the firewall's IP address.

Associate the route table with the source subnet.

The route table is associated with `Subnet-Web`.

Routing decisions are applied to outbound traffic leaving a subnet; therefore, the route table must be associated with the subnet hosting the source resources.

Configure the network interface of the firewall virtual machine to allow transit traffic.

IP forwarding is enabled on the network interface of `NVA1`.

By default, Azure network interfaces drop packets that do not match the interface's IP address. Enabling IP forwarding allows the interface to receive and forward transit network traffic.

Key Concept

User-Defined Routes (UDRs) allow administrators to override default system routing tables. To route traffic through a Network Virtual Appliance (NVA), you must specify a next hop type of Virtual appliance, provide the NVA's local IP address, associate the route table with the originating subnet, and enable IP forwarding on the NVA's network interface.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics