You are configuring routing and security for a hub-and-spoke virtual network topology in M… — Microsoft Azure Administrator (AZ-104)

You are configuring routing and security for a hub-and-spoke virtual network topology in Microsoft Azure. The topology contains the following networks:

- A hub virtual network (VNet-Hub) with an address space of $10.100.0.0/16$ .
- A spoke virtual network (VNet-Spoke1) with an address space of $10.101.0.0/16$ .
- A spoke virtual network (VNet-Spoke2) with an address space of $10.102.0.0/16$ .

VNet-Spoke1 and VNet-Spoke2 are peered with VNet-Hub. There is no direct peering between VNet-Spoke1 and VNet-Spoke2. You deploy an Azure Firewall in VNet-Hub, which is assigned the private IP address $10.100.4.4$ .

You must meet the following requirements:
- All traffic between VNet-Spoke1 and VNet-Spoke2 must be routed through and inspected by the Azure Firewall.
- All outbound internet traffic from both spoke virtual networks must be routed through and inspected by the Azure Firewall.
- The firewall subnet must be configured according to Microsoft recommendations and support future scalability.

Which three configurations must you perform to meet these requirements? (Select three.)

Create a subnet in VNet-Hub named AzureFirewallSubnet with an address range of $10.100.4.0/26$ or larger, and ensure no Network Security Group (NSG) is associated with this subnet.Answer
In the route table associated with VNet-Spoke1, configure a route for $10.102.0.0/16$ and a route for $0.0.0.0/0$ , both with the next hop type set to 'Virtual Appliance' and the next hop IP address set to $10.100.4.4$ .Answer
In the route table associated with VNet-Spoke2, configure a route for $10.101.0.0/16$ and a route for $0.0.0.0/0$ , both with the next hop type set to 'Virtual Appliance' and the next hop IP address set to $10.100.4.4$ .Answer
D
In the route tables for VNet-Spoke1 and VNet-Spoke2, configure the next hop type as 'Virtual Network Gateway' and specify $10.100.4.4$ as the next hop IP address.
E
In VNet-Spoke1 and VNet-Spoke2, associate a route table containing only a single route for $0.0.0.0/0$ with a next hop type of 'Virtual Appliance' and the next hop IP address set to $10.100.4.4$ .
F
Create a subnet in VNet-Hub named AzureFirewallSubnet with an address range of $10.100.4.0/28$ , and associate a Network Security Group (NSG) configured with a high-priority rule to allow all inbound traffic from the spoke networks.

Answer

The correct configurations are: creating a subnet in the hub virtual network named AzureFirewallSubnet with a prefix size of at least

/26

and no associated Network Security Group; configuring a route table in VNet-Spoke1 with routes for

10.102.0.0/16

and

0.0.0.0/0

pointing to the firewall's IP as a Virtual Appliance; and configuring a route table in VNet-Spoke2 with routes for

10.101.0.0/16

and

0.0.0.0/0

pointing to the firewall's IP as a Virtual Appliance.

The correct configurations involve creating a subnet named 'AzureFirewallSubnet' in the hub virtual network with a prefix of at least

/26

and no associated NSG, which meets the platform and scalability requirements. To inspect spoke-to-spoke traffic, you must configure UDRs in both VNet-Spoke1 and VNet-Spoke2 that explicitly route the peered spokes' CIDR blocks (e.g., VNet-Spoke1 routing

10.102.0.0/16

and VNet-Spoke2 routing

10.101.0.0/16

) and outbound internet traffic (

0.0.0.0/0

) to the firewall's private IP (

10.100.4.4

) using the 'Virtual Appliance' next hop type.

Step-by-Step Solution

Evaluate the subnet requirements for deploying Azure Firewall.

The firewall must be placed in a dedicated subnet named AzureFirewallSubnet with a prefix size of at least

/26

. It must not have any associated NSGs.

This is a Microsoft platform requirement to ensure scalability, allow updates, and prevent management traffic blockages.

Analyze spoke-to-spoke routing with direct peering and Longest Prefix Match (LPM).

Identify that the system route created by peering (e.g.,

10.102.0.0/16

in VNet-Spoke1) is more specific than a default route (

0.0.0.0/0

In Azure routing, User-Defined Routes (UDRs) are required to override system routes. Because system routes are specific, a simple default route (

0.0.0.0/0

) pointing to the firewall would be ignored for peered VNet traffic. An explicit UDR matching the peered spoke's address space is required.

Configure the route table for VNet-Spoke1.

Add a route for

10.102.0.0/16

and a route for

0.0.0.0/0

, setting the next hop type to 'Virtual Appliance' and next hop IP to

10.100.4.4

This ensures both spoke-to-spoke traffic (destined for VNet-Spoke2) and internet-bound traffic from VNet-Spoke1 are redirected to the firewall.

Configure the route table for VNet-Spoke2.

Add a route for

10.101.0.0/16

and a route for

0.0.0.0/0

, setting the next hop type to 'Virtual Appliance' and next hop IP to

10.100.4.4

This ensures both spoke-to-spoke traffic (destined for VNet-Spoke1) and internet-bound traffic from VNet-Spoke2 are redirected to the firewall.

Key Concept

Azure Firewall routing configuration in a hub-and-spoke topology requires setting up specific UDRs for peered address spaces to override the default system peering routes due to Longest Prefix Match (LPM) rules, alongside configuring the AzureFirewallSubnet with correct naming, sizing, and security constraints.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic