An Azure administrator is designing the routing for a virtual network named `VNet-Internal… — Microsoft Azure Administrator (AZ-104)

An Azure administrator is designing the routing for a virtual network named `VNet-Internal` ( $172.30.0.0/16$ ). The virtual network contains the following subnets:

* `Subnet-Web` ( $172.30.10.0/24$ )
* `Subnet-App` ( $172.30.20.0/24$ )
* `Subnet-DMZ` ( $172.30.30.0/24$ )

A virtual appliance named `NVA-Firewall` is deployed in `Subnet-DMZ` and is assigned the private IP address $172.30.30.5$ . IP forwarding is disabled on the network interface of `NVA-Firewall`.

You assign a custom route table named `RT-Web` to `Subnet-Web`. The route table contains the following rules:

* Route 1: Destination address prefix $172.30.20.0/24$ ; Next hop type: Virtual appliance; Next hop IP address $172.30.30.5$
* Route 2: Destination address prefix $172.30.0.0/16$ ; Next hop type: None

A virtual machine in `Subnet-Web` attempts to initiate a TCP connection to a server in `Subnet-App` at the IP address $172.30.20.15$ .

What will happen to this network traffic?

The traffic will be sent to the network interface of the virtual appliance and then discarded.Answer
B
The traffic will be discarded at the subnet level before leaving the source subnet.
C
The traffic will bypass the user-defined routes and be delivered directly to the server using the default system route.
D
The traffic will be forwarded to the Virtual Network Gateway for routing.

Answer

The traffic will be sent to the network interface of the virtual appliance and then discarded.

The traffic will be forwarded to the virtual appliance because the user-defined route for the application subnet is a more specific match than the route for the entire virtual network. Since IP forwarding is disabled on the network interface of the virtual appliance, the interface will discard any packets not addressed to its own IP address.

Step-by-Step Solution

Determine the applicable routes for the destination IP address

172.30.20.15

from `Subnet-Web`.

The two matching routes in the route table are Route 1 (

172.30.20.0/24

) and Route 2 (

172.30.0.0/16

Both routes cover the destination IP address, but Route 1 has a more specific prefix.

Apply the Longest Prefix Match (LPM) rule to select the active route.

Route 1 (

172.30.20.0/24

) takes precedence over Route 2 (

172.30.0.0/16

Azure uses the most specific route prefix (longest prefix match) to forward traffic.

Analyze the next hop behavior and NVA configuration.

Traffic is forwarded to the next hop IP

172.30.30.5

. However, since the network interface of the virtual appliance does not have IP forwarding enabled, it drops the packets.

A network interface on an Azure VM drops packets destined for other IP addresses unless IP forwarding is explicitly enabled on that interface.

Key Concept

User-defined route precedence, Longest Prefix Match (LPM), and the requirement for IP forwarding on NVAs.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics