Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

An administrator is configuring connectivity for three virtual networks in the East US region:

* `VNet-Hub` (10.240.0.0/1610.240.0.0/16) contains a subnet with deployed virtual machines and a Virtual Network Gateway configured for site-to-site VPN connectivity.
* `VNet-Spoke1` (10.241.0.0/1610.241.0.0/16) contains a subnet with deployed virtual machines.
* `VNet-Spoke2` (10.242.0.0/1610.242.0.0/16) contains a subnet with deployed virtual machines.

A virtual network peering link is established between `VNet-Hub` and `VNet-Spoke1` with 'Allow gateway transit' enabled on `VNet-Hub` and 'Use remote gateways' enabled on `VNet-Spoke1`.

A second virtual network peering link is established between `VNet-Spoke1` and `VNet-Spoke2` with 'Allow forwarded traffic' enabled on both sides.

Which of the following actions must the administrator perform to allow the virtual machines in `VNet-Spoke2` to communicate with the on-premises network via the Virtual Network Gateway in `VNet-Hub`?

  1. Configure a direct virtual network peering between `VNet-Hub` and `VNet-Spoke2` with 'Allow gateway transit' enabled on `VNet-Hub` and 'Use remote gateways' enabled on `VNet-Spoke2`.Answer
  2. B
    Enable 'Use remote gateways' on the existing peering link between `VNet-Spoke1` and `VNet-Spoke2` on the `VNet-Spoke2` side.
  3. C
    Configure a User-Defined Route (UDR) in `VNet-Spoke2` with a next hop type of Virtual Network Gateway and associate it with the subnet containing the virtual machines.
  4. D
    Enable 'Allow gateway transit' on the peering link between `VNet-Hub` and `VNet-Spoke1` on the `VNet-Spoke1` side.

Answer

Configure a direct virtual network peering between `VNet-Hub` and `VNet-Spoke2` with 'Allow gateway transit' enabled on `VNet-Hub` and 'Use remote gateways' enabled on `VNet-Spoke2`.
The correct action is to configure a direct virtual network peering between the gateway host network and the target spoke network, ensuring gateway transit and remote gateway options are enabled. This is because Azure virtual network peering is non-transitive, meaning a spoke network cannot transitively access a virtual network gateway in another network through a middle peered network.

Step-by-Step Solution

1
Analyze the virtual network topology and gateway transit requirements.
Identify that `VNet-Hub` contains the gateway, while `VNet-Spoke2` is transitively connected via `VNet-Spoke1`.
Understanding the limits of virtual network peering transitivity is essential to resolving routing paths.
2
Recognize the limitation of gateway transit over peered VNets.
Confirm that gateway transit is not transitive across peered networks, meaning `VNet-Spoke2` cannot use the gateway in `VNet-Hub` through `VNet-Spoke1`.
Azure virtual network peering is non-transitive, and gateway sharing only works over a direct peering link.
3
Select the correct configuration to enable gateway transit for the target network.
Create a direct peering link between `VNet-Hub` and `VNet-Spoke2` and enable the appropriate gateway transit options on both sides.
Direct peering with 'Allow gateway transit' on the gateway VNet and 'Use remote gateways' on the spoke VNet is the standard Azure method to share a VPN or ExpressRoute gateway.

Key Concept

Azure Virtual Network Peering is non-transitive. To share a Virtual Network Gateway, a direct peering connection must exist between the gateway host virtual network and the spoke virtual network, with gateway transit and remote gateway settings configured.
Estimated Time:1m 30s
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic