An organization has a hub-and-spoke virtual network topology in Microsoft Azure configured… — Microsoft Azure Administrator (AZ-104)

An organization has a hub-and-spoke virtual network topology in Microsoft Azure configured as follows:
- VNet-Hub (address space $10.100.0.0/16$ ) contains a subnet named Subnet-DMZ ( $10.100.1.0/24$ ) and a subnet named Subnet-Data ( $10.100.5.0/24$ ).
- Subnet-DMZ hosts a Network Virtual Appliance (NVA) with the private IP address $10.100.1.4$ .
- VNet-Spoke1 (address space $10.101.0.0/16$ ) contains a subnet named Subnet-App1 ( $10.101.1.0/24$ ).
- VNet-Hub and VNet-Spoke1 are connected via virtual network peering with default settings.

You must implement a routing policy for traffic originating from Subnet-App1 that meets the following requirements:
1. All traffic destined for the hub virtual network ( $10.100.0.0/16$ ) must be inspected by the NVA.
2. All traffic destined for the database servers in Subnet-Data ( $10.100.5.0/24$ ) must bypass the NVA and connect directly over the virtual network peering connection.
3. The NVA must be permitted to forward traffic that is not destined for its local network interfaces.

Which three configuration steps should you perform to meet these requirements? (Select three.)

Enable IP forwarding on the Azure network interface associated with the Network Virtual Appliance (NVA).Answer
Create a route table, associate it with Subnet-App1, and add a route for $10.100.0.0/16$ with a next hop type of Virtual appliance and a next hop IP address of $10.100.1.4$ .Answer
In the route table associated with Subnet-App1, add a route for $10.100.5.0/24$ with a next hop type of Virtual network.Answer
D
In the route table associated with Subnet-App1, add a route for $10.100.5.0/24$ with a next hop type of Virtual network gateway.
E
Create a route table, associate it with Subnet-DMZ, and add a route for $10.100.5.0/24$ with a next hop type of Virtual network.
F
Enable IP forwarding on the Azure network interfaces of all virtual machines residing in Subnet-App1.

Answer

To meet the requirements, you must enable IP forwarding on the Network Virtual Appliance (NVA) network interface, create a route table associated with Subnet-App1 containing a route for

10.100.0.0/16

pointing to the NVA (

10.100.1.4

) as a Virtual Appliance, and add a more specific route in the same route table for

10.100.5.0/24

with a next hop type of Virtual network to allow database traffic to bypass the NVA.

To inspect traffic destined for the hub VNet from the spoke, a User-Defined Route (UDR) for

10.100.0.0/16

with a next hop of Virtual Appliance (pointing to the NVA's IP) must be applied to the application subnet. To bypass this NVA for the database subnet (

10.100.5.0/24

), Azure's Longest Prefix Match (LPM) algorithm is leveraged by adding a more specific route for

10.100.5.0/24

with a next hop type of Virtual network, which directs the traffic directly over the peered connection. Lastly, the NVA's network interface in Azure must have IP forwarding enabled so that it is permitted to process and forward packets that do not originate from or terminate at its own IP address.

Step-by-Step Solution

Configure the NVA's NIC settings in Azure.

IP forwarding is enabled on the network interface of the NVA (

10.100.1.4

), allowing it to process and forward packets destined for other IP addresses.

By default, Azure drops traffic sent to a VM NIC if the destination IP does not match the NIC's own IP configuration.

Define the broader route to redirect traffic to the NVA.

A route table is created and associated with Subnet-App1. A route for

10.100.0.0/16

is added with next hop type Virtual appliance pointing to

10.100.1.4

This redirects all traffic destined for VNet-Hub to the NVA for security inspection, overriding the default system route that would send it directly via peering.

Define the bypass route for the database subnet.

A route for

10.100.5.0/24

with next hop type Virtual network is added to the same route table.

Due to Azure's Longest Prefix Match (LPM) rule, traffic to

10.100.5.0/24

matches this prefix instead of the broader

10.100.0.0/16

prefix, directing the traffic over the peered network path directly and bypassing the NVA.

Key Concept

Azure User-Defined Routes (UDR) next hop selection, Longest Prefix Match (LPM) precedence, and NVA IP forwarding requirements.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics