You have an Azure subscription containing three peered virtual networks: * `VNet-Hub` (10.… — Microsoft Azure Administrator (AZ-104)

You have an Azure subscription containing three peered virtual networks:

* `VNet-Hub` ( $10.10.0.0/16$ ) containing a subnet named `Subnet-NVA` ( $10.10.1.0/24$ )
* `VNet-Spoke1` ( $10.20.0.0/16$ ) containing a subnet named `Subnet-Web` ( $10.20.1.0/24$ )
* `VNet-Spoke2` ( $10.30.0.0/16$ ) containing two subnets named `Subnet-DB` ( $10.30.1.0/24$ ) and `Subnet-Mgmt` ( $10.30.2.0/24$ )

A Network Virtual Appliance (NVA) is deployed in `Subnet-NVA` with the IP address $10.10.1.4$ .

You have already configured a route table associated with `Subnet-Web` that contains a route for $10.30.0.0/16$ with a next hop of the NVA at $10.10.1.4$ .

You need to ensure that:

1. Traffic from `Subnet-Web` to `Subnet-DB` is routed through the NVA.
2. Traffic from `Subnet-Web` to `Subnet-Mgmt` bypasses the NVA and is routed directly across the peered virtual networks.
3. The NVA can successfully receive and forward packets that are not destined for itself.

Which two configurations should you perform? (Select two.)

In the route table associated with Subnet-Web, add a route for $10.30.2.0/24$ with a next hop type of Virtual network.Answer
Enable IP forwarding on the Azure network interface of the NVA virtual machine.Answer
C
In the route table associated with Subnet-Web, add a route for $10.30.2.0/24$ with a next hop type of Virtual Network Gateway.
D
Enable IP forwarding on the Azure network interfaces of the virtual machines in Subnet-Web.
E
Associate the route table containing the NVA route with Subnet-NVA.

Answer

The correct configurations are: adding a route for

10.30.2.0/24

with a next hop type of Virtual network in the route table associated with Subnet-Web, and enabling IP forwarding on the network interface of the NVA virtual machine.

Adding a route for

10.30.2.0/24

with a next hop type of Virtual network uses the Longest Prefix Match (LPM) mechanism. Since this prefix is more specific than the existing

10.30.0.0/16

route, traffic to Subnet-Mgmt will match this route and be forwarded using the direct virtual network peering system routes. Additionally, the NVA must have IP forwarding enabled on its Azure network interface (NIC) so that it does not drop packets that are addressed to other destinations.

Step-by-Step Solution

Analyze the existing route table on Subnet-Web

The route table has a route for

10.30.0.0/16

pointing to the NVA (

10.10.1.4

). This currently intercepts all traffic to both Subnet-DB (

10.30.1.0/24

) and Subnet-Mgmt (

10.30.2.0/24

To understand how traffic to VNet-Spoke2 is currently being routed.

Determine how to bypass the NVA for Subnet-Mgmt using Longest Prefix Match (LPM)

Create a more specific route for

10.30.2.0/24

than the broad

10.30.0.0/16

route.

Azure routing selects the route with the longest prefix match. A route for

10.30.2.0/24

will override the

10.30.0.0/16

route for traffic destined to Subnet-Mgmt.

Identify the correct next hop type for direct peered routing

Select 'Virtual network' as the next hop type for the

10.30.2.0/24

route.

This tells Azure to use the default system route for peered virtual networks instead of redirecting the traffic elsewhere.

Address the packet forwarding requirement on the NVA

Enable IP forwarding on the Azure network interface (NIC) of the NVA VM.

By default, Azure VMs drop packets where the destination IP does not match the VM's IP. The NVA must have IP forwarding enabled to process and route transit traffic.

Key Concept

User-Defined Routes (UDR) next hop configurations and Longest Prefix Match (LPM) precedence rules in Azure.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics