Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

An Azure administrator deploys three virtual networks in the East US region:

* `VNet-Hub` (192.168.0.0/16192.168.0.0/16) contains a subnet named `Subnet-Hub` with a virtual machine named `VM-Hub`.
* `VNet-Spoke1` (192.168.1.0/24192.168.1.0/24) contains a subnet named `Subnet-Spoke1` with a virtual machine named `VM-1`.
* `VNet-Spoke2` (192.168.2.0/24192.168.2.0/24) contains a subnet named `Subnet-Spoke2` with a virtual machine named `VM-2`.

You configure virtual network peering between `VNet-Hub` and `VNet-Spoke1`, and between `VNet-Hub` and `VNet-Spoke2`. `VM-Hub` can communicate with both `VM-1` and `VM-2`. However, `VM-1` and `VM-2` are unable to communicate with each other.

Which of the following configuration changes must you perform to enable direct network connectivity between `VM-1` and `VM-2`?

  1. A
    Enable the Allow gateway transit setting on the peering connections for VNet-Hub, and the Use remote gateways setting on the peering connections for VNet-Spoke1 and VNet-Spoke2.
  2. B
    Configure a User-Defined Route (UDR) in VNet-Spoke1 and VNet-Spoke2 with the next hop type set to Virtual Network Gateway pointing to VNet-Hub.
  3. Configure a virtual network peering connection directly between VNet-Spoke1 and VNet-Spoke2.Answer
  4. D
    Enable the Allow forwarded traffic setting on the virtual network peering connections between VNet-Hub and both spoke virtual networks.

Answer

Configure a virtual network peering connection directly between VNet-Spoke1 and VNet-Spoke2.
Virtual network peering is non-transitive. Traffic cannot transit a middle virtual network (hub) to reach another peered virtual network (spoke) unless a Network Virtual Appliance (NVA) is deployed in the hub. To enable direct communication between the two spoke virtual networks without an NVA, a direct peering link must be created between them.

Step-by-Step Solution

1
Analyze the topology and connectivity issue.
VNet-Hub is peered with both VNet-Spoke1 and VNet-Spoke2. However, VM-1 in VNet-Spoke1 cannot communicate with VM-2 in VNet-Spoke2 because virtual network peering is non-transitive.
By design, traffic cannot transit a middle virtual network (VNet-Hub) to reach another peered network unless a routing device (like a Network Virtual Appliance) is configured in that hub.
2
Evaluate configuration settings required to bypass non-transitivity directly.
To allow VM-1 and VM-2 to communicate directly without passing through VNet-Hub, a direct network path must be established.
Establishing direct peering between VNet-Spoke1 and VNet-Spoke2 bypasses VNet-Hub entirely.
3
Confirm the correct configuration action.
Configure a bidirectional virtual network peering directly between VNet-Spoke1 and VNet-Spoke2.
This establishes direct, low-latency communication between the two spoke networks.

Key Concept

Virtual network peering is non-transitive by default. To route traffic between two spokes, you must either peer them directly or route traffic through a Network Virtual Appliance (NVA) in the hub using User-Defined Routes.
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic