An organization deploys a hub-and-spoke network topology in Azure. The hub network (`VNet-… — Microsoft Azure Administrator (AZ-104)

An organization deploys a hub-and-spoke network topology in Azure. The hub network (`VNet-Hub`) hosts an Azure Firewall in the subnet `AzureFirewallSubnet` with the private IP address $10.1.0.4$ . A peered spoke network (`VNet-Spoke`) hosts a workload subnet named `Subnet-App` ( $10.2.1.0/24$ ).

To comply with security guidelines, all outbound internet traffic from `Subnet-App` must be inspected by the firewall in the hub.

Which two configurations are required to meet this requirement? (Select two.)

Create a route table, add a route for $0.0.0.0/0$ with the next hop type set to Virtual appliance and the next hop address set to $10.1.0.4$ , and associate the route table with `Subnet-App`.Answer
Configure a Network rule or Application rule in the Azure Firewall to allow traffic from the source IP address range $10.2.1.0/24$ to the internet.Answer
C
Configure the virtual network peering from `VNet-Spoke` to `VNet-Hub` to use remote virtual network gateways.
D
Create a route table, add a route for $0.0.0.0/0$ with the next hop type set to Virtual network gateway and the next hop address set to $10.1.0.4$ , and associate the route table with `Subnet-App`.

Answer

To route and permit internet traffic through the firewall, you must create a route table associated with the application subnet containing a route for 0.0.0.0/0 with a next hop type of Virtual appliance pointing to the firewall's private IP, and configure a Network or Application rule in the Azure Firewall to permit the traffic.

To route outbound traffic from a subnet through an Azure Firewall, you must create a User-Defined Route (UDR) in a route table associated with the subnet. The route must specify a destination of 0.0.0.0/0 (all internet-bound traffic), a next hop type of Virtual appliance, and the private IP address of the Azure Firewall as the next hop address. Additionally, because Azure Firewall is a stateful firewall with a default-deny policy, you must configure a Network rule or an Application rule to explicitly allow the outbound traffic from the subnet to the internet.

Step-by-Step Solution

Associate a custom route table with the workload subnet.

System routes for the subnet can now be overridden by User-Defined Routes (UDRs).

By default, Azure subnets route internet traffic directly. A custom route table is required to redirect this traffic.

Add a route to the route table with destination 0.0.0.0/0, next hop type Virtual appliance, and the firewall's private IP as the next hop address.

All outbound internet-bound traffic from the subnet is forwarded to the Azure Firewall.

The Virtual appliance next hop type tells Azure routing to send the traffic to the specified firewall IP instead of direct internet routing.

Add an Allow rule (Network or Application) to the Azure Firewall configuration matching the source subnet and destination.

The firewall evaluates the rule and allows the outbound traffic rather than dropping it by default.

Azure Firewall operates on a zero-trust model and drops all traffic unless an explicit allow rule is configured.

Key Concept

Configuring routing via User-Defined Routes (UDRs) and configuring rules in Azure Firewall to control traffic flow.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic