An administrator manages a virtual network named `VNet-Sales` with the address space 172.2… — Microsoft Azure Administrator (AZ-104)

An administrator manages a virtual network named `VNet-Sales` with the address space $172.20.0.0/16$ . The virtual network contains the following subnets:

* `Subnet-Web`: $172.20.10.0/24$
* `Subnet-App`: $172.20.20.0/24$
* `Subnet-Security`: $172.20.30.0/24$

A custom security appliance named `NVA-Firewall` is deployed in `Subnet-Security` with the IP address $172.20.30.4$ . IP forwarding is enabled on the network interface of `NVA-Firewall`.

The administrator wants to ensure that all traffic from `Subnet-Web` destined for `Subnet-App` is routed through `NVA-Firewall` for inspection.

Which route table configuration and association should the administrator apply to achieve this goal?

A
Create a route with a destination prefix of $172.20.20.0/24$ , set the next hop type to Virtual Network Gateway, specify the next hop IP address as $172.20.30.4$ , and associate the route table with Subnet-Web.
Create a route with a destination prefix of $172.20.20.0/24$ , set the next hop type to Virtual appliance, specify the next hop IP address as $172.20.30.4$ , and associate the route table with Subnet-Web.Answer
C
Create a route with a destination prefix of $172.20.20.0/24$ , set the next hop type to Virtual appliance, specify the next hop IP address as $172.20.30.4$ , and associate the route table with Subnet-App.
D
Create a route with a destination prefix of $172.20.0.0/16$ , set the next hop type to Virtual appliance, specify the next hop IP address as $172.20.30.4$ , and associate the route table with Subnet-Web.

Answer

Create a route with a destination prefix of

172.20.20.0/24

, set the next hop type to Virtual appliance, specify the next hop IP address as

172.20.30.4

, and associate the route table with Subnet-Web.

To route traffic from Subnet-Web to Subnet-App through a Network Virtual Appliance (NVA), you must associate a route table with the source subnet (Subnet-Web). The route in the route table must target the destination subnet (Subnet-App:

172.20.20.0/24

) and use the 'Virtual appliance' next hop type pointing to the private IP address of the NVA (

172.20.30.4

). Since a specific subnet route (

172.20.20.0/24

) is more specific than the default virtual network local route (

172.20.0.0/16

), Azure's Longest Prefix Match (LPM) rule ensures that traffic to Subnet-App is directed to the NVA.

Step-by-Step Solution

Identify the source of the traffic flow and the required subnet association.

The traffic originates from Subnet-Web. Therefore, the User-Defined Route (UDR) table must be associated with Subnet-Web to govern its outbound routing.

Azure route tables only affect outbound traffic originating from resources in the subnets to which the route table is associated.

Determine the correct destination IP prefix and routing precedence.

The target destination subnet is Subnet-App (

172.20.20.0/24

By defining a specific route for

172.20.20.0/24

, Azure's Longest Prefix Match (LPM) logic selects this route over the more general default virtual network system route (

172.20.0.0/16

Specify the next hop type and next hop IP address for the firewall VM.

The next hop type must be set to 'Virtual appliance' and the next hop IP address must be set to the NVA's interface IP (

172.20.30.4

A custom VM serving as a firewall is classified as a Virtual appliance in Azure. The next hop IP address must be within a subnet located inside the same virtual network or a peered virtual network.

Key Concept

User-Defined Routes (UDR) Next Hop and Subnet Association

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics