Your company has an Azure subscription containing two peered virtual networks: `VNet1` (10… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure subscription containing two peered virtual networks: `VNet1` ( $10.10.0.0/16$ ) and `VNet2` ( $10.20.0.0/16$ ). `VNet1` contains a subnet named `Subnet-Web` ( $10.10.1.0/24$ ) and a subnet named `Subnet-Sec` ( $10.10.10.0/24$ ). A Network Virtual Appliance (NVA) with the private IP address $10.10.10.4$ is deployed in `Subnet-Sec` and has IP forwarding enabled on its network interface. `VNet2` contains two subnets named `Subnet-App` ( $10.20.1.0/24$ ) and `Subnet-DB` ( $10.20.2.0/24$ ). You associate a user-defined route table named `RT-Web` with `Subnet-Web`. You must ensure that traffic from `Subnet-Web` destined for the database servers in `Subnet-DB` is routed through the NVA for security inspection, while traffic destined for the application servers in `Subnet-App` continues to use the direct peering connection. Which route should you add to `RT-Web`?

Address prefix: $10.20.2.0/24$ , Next hop type: Virtual appliance, Next hop IP address: $10.10.10.4$ Answer
B
Address prefix: $10.20.0.0/16$ , Next hop type: Virtual appliance, Next hop IP address: $10.10.10.4$
C
Address prefix: $10.20.2.0/24$ , Next hop type: Virtual network gateway, Next hop IP address: $10.10.10.4$
D
Address prefix: $10.20.2.0/24$ , Next hop type: Virtual network

Answer

Address prefix:

10.20.2.0/24

, Next hop type: Virtual appliance, Next hop IP address:

10.10.10.4

The correct configuration uses the address prefix

10.20.2.0/24

to match only the database subnet traffic. By specifying the next hop type as 'Virtual appliance' and the next hop IP address as

10.10.10.4

, traffic to the database subnet is redirected to the NVA. Traffic destined for the application subnet (

10.20.1.0/24

) does not match this prefix and instead falls back to the default peered virtual network system route (

10.20.0.0/16

), fulfilling all requirements.

Step-by-Step Solution

Identify the target destination subnet and its IP range.

The target destination for the security inspection is `Subnet-DB` which has the prefix

10.20.2.0/24

We need to ensure that only traffic destined for this specific subnet is routed to the NVA.

Determine the required route prefix to satisfy the routing requirements.

Using a prefix of

10.20.2.0/24

targets only `Subnet-DB`. Using a prefix of

10.20.0.0/16

would also route `Subnet-App` (

10.20.1.0/24

) traffic through the NVA, which violates the requirement to use the direct peering connection.

Azure routing uses the Longest Prefix Match (LPM) rule. If we define a route for

10.20.2.0/24

, it is a more specific match than the system route for VNet peering (

10.20.0.0/16

) and will override it for `Subnet-DB` traffic. `Subnet-App` traffic will still match the system route.

Select the correct next hop type and next hop IP address.

The next hop type must be 'Virtual appliance', and the next hop IP address must be the private IP of the NVA, which is

10.10.10.4

An NVA is a custom virtual machine that acts as a router/firewall. Traffic must be directed to its specific interface IP address using the 'Virtual appliance' type.

Key Concept

Azure User-Defined Routes (UDR) override system routes when a user-defined route has a matching or more specific prefix (Longest Prefix Match). For routing traffic through a Network Virtual Appliance (NVA), the next hop type must be 'Virtual appliance' and the next hop IP address must match the NVA's interface IP.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics