You support an Azure infrastructure with a hub-and-spoke virtual network topology. The hub… — Microsoft Azure Administrator (AZ-104)

You support an Azure infrastructure with a hub-and-spoke virtual network topology. The hub virtual network is named `Hub-VNet` ( $10.200.0.0/16$ ) and contains a firewall appliance in subnet `FirewallSubnet` ( $10.200.1.0/24$ ) with a private IP address of $10.200.1.4$ . A spoke virtual network named `Spoke1-VNet` ( $10.1.0.0/16$ ) contains a backend processing subnet named `BackendSubnet` ( $10.1.2.0/24$ ). `Hub-VNet` and `Spoke1-VNet` are connected using virtual network peering with transit settings configured.

You must direct all outbound internet traffic from virtual machines located in `BackendSubnet` through the firewall appliance in the hub.

Which two configuration actions are required to achieve this routing behavior? (Select two.)

Associate a route table with `BackendSubnet` that contains a route with the destination prefix $0.0.0.0/0$ , a next hop type of Virtual appliance, and a next hop IP address of $10.200.1.4$ .Answer
Enable IP forwarding on the network interface of the firewall appliance in the hub.Answer
C
Associate a route table with `BackendSubnet` that contains a route with the destination prefix $0.0.0.0/0$ , a next hop type of Virtual Network Gateway, and a next hop IP address of $10.200.1.4$ .
D
Enable IP forwarding within the subnet properties of `BackendSubnet` and `FirewallSubnet`.

Answer

Associate a route table with the backend subnet containing a route with the destination prefix

0.0.0.0/0

and a next hop type of Virtual appliance pointing to the firewall IP address, and enable IP forwarding on the firewall's network interface.

To route outbound internet traffic from a spoke subnet through a firewall appliance in the hub, you must create a User-Defined Route (UDR) for

0.0.0.0/0

with a next hop type of Virtual appliance pointing to the firewall's IP address and associate it with the spoke subnet. Additionally, the firewall's network interface must have IP forwarding enabled so it can process and forward traffic intended for other destinations.

Step-by-Step Solution

Define the custom route for outbound internet traffic.

A route table is configured with a route for destination prefix

0.0.0.0/0

pointing to the firewall appliance's private IP (

10.200.1.4

) as a Virtual appliance.

This overrides the Azure default system route for internet access (

0.0.0.0/0

) which normally routes directly to the Internet.

Associate the route table with the spoke subnet.

The route table is associated with `BackendSubnet`.

Routing tables only apply to subnets with which they are explicitly associated.

Enable IP forwarding on the network virtual appliance (NVA) network interface.

IP forwarding is enabled on the network interface (NIC) of the firewall VM.

By default, Azure VMs discard traffic they receive that is not addressed to their own IP. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Key Concept

Routing spoke traffic through a hub NVA requires a route table with a Virtual appliance next hop associated with the spoke subnet, along with enabling IP forwarding on the NVA's NIC.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics