Question

Difficulty: EasyConfigure Virtual Network Peering

You have three virtual networks named VNet-Prod (address space 10.10.0.0/1610.10.0.0/16), VNet-Hub (address space 10.20.0.0/1610.20.0.0/16), and VNet-Shared (address space 10.30.0.0/1610.30.0.0/16). Virtual machines are deployed in the subnets of all three virtual networks to verify connectivity.

You configure virtual network peering between VNet-Prod and VNet-Hub. You also configure virtual network peering between VNet-Hub and VNet-Shared. For both peering connections, 'Allow virtual network access' is enabled, 'Allow forwarded traffic' is disabled, and 'Use remote gateways' and 'Allow gateway transit' are disabled.

An administrator attempts to establish direct network communication between a virtual machine in VNet-Prod and a virtual machine in VNet-Shared.

Which of the following describes the outcome of this network communication?

  1. The communication will fail because virtual network peering is non-transitive by default, and traffic cannot route from VNet-Prod to VNet-Shared through VNet-Hub.Answer
  2. B
    The communication will succeed automatically because virtual network peering is inherently transitive across all virtual networks within the same subscription.
  3. C
    The communication will succeed because both virtual networks automatically share private DNS name resolution through VNet-Hub without requiring virtual network links.
  4. D
    The communication will succeed only if a route is added to the routing table with a next hop type of Virtual Network Gateway pointing to VNet-Hub.

Answer

The communication will fail because virtual network peering is non-transitive by default, and traffic cannot route from VNet-Prod to VNet-Shared through VNet-Hub.
The correct answer is that the communication will fail because virtual network peering is non-transitive by default. Traffic from VNet-Prod cannot transit through VNet-Hub to reach VNet-Shared unless gateway transit or a network virtual appliance (NVA) is configured.

Step-by-Step Solution

1
Analyze the peering topology.
Identify that VNet-Prod is peered with VNet-Hub, and VNet-Hub is peered with VNet-Shared, but VNet-Prod is not peered with VNet-Shared.
Understanding the direct point-to-point links is necessary to determine routing paths.
2
Check the default peering transitivity behavior.
Acknowledge that Azure virtual network peering is non-transitive, meaning traffic cannot pass through VNet-Hub to go between VNet-Prod and VNet-Shared.
This is the core architectural rule of Azure virtual network peering.
3
Evaluate configuration settings.
Confirm that transit features (gateways/NVA) are not enabled, verifying that no routing path exists between VNet-Prod and VNet-Shared.
To conclude that the VM-to-VM communication will fail.

Key Concept

Azure virtual network peering is non-transitive. Point-to-point connections do not automatically route transit traffic through a middle virtual network unless a gateway or network virtual appliance (NVA) is used along with appropriate routing rules.
Estimated Time:1m 0s
Rate this question