An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virt… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-weur-hub` (address space: $10.100.0.0/16$ ), contains a subnet `snet-firewall` ( $10.100.1.0/24$ ) hosting a firewall Network Virtual Appliance (NVA) at IP address $10.100.1.4$ . Another subnet in the hub, `snet-shared` ( $10.100.2.0/24$ ), hosts a shared DNS server at IP address $10.100.2.10$ .

The spoke virtual network, `vnet-weur-prod-app` (address space: $10.110.0.0/16$ ), is connected to `vnet-weur-hub` using virtual network peering with default settings. Inside `vnet-weur-prod-app`, there are two subnets: `snet-web` ( $10.110.10.0/24$ ) hosting web servers and `snet-db` ( $10.110.20.0/24$ ) hosting database servers (including a database server at $10.110.20.5$ ).

To enforce security, a route table named `rt-snet-web` is associated with `snet-web` and configured with the following user-defined routes (UDRs):
- Route 1: Address prefix $0.0.0.0/0$ , Next hop type: Virtual appliance, Next hop IP address: $10.100.1.4$
- Route 2: Address prefix $10.0.0.0/8$ , Next hop type: Virtual appliance, Next hop IP address: $10.100.1.4$

What is the routing behavior for outbound traffic originating from a web server in `snet-web` ( $10.110.10.5$ ) destined for the database server ( $10.110.20.5$ ) and the DNS server ( $10.100.2.10$ )?

Traffic to both the database server and the DNS server bypasses the firewall NVA.Answer
B
Traffic to both the database server and the DNS server is routed to the firewall NVA.
C
Traffic to the database server is routed to the firewall NVA, while traffic to the DNS server bypasses the firewall NVA.
D
Traffic to the DNS server is routed to the firewall NVA, while traffic to the database server bypasses the firewall NVA.

Answer

Traffic to both the database server and the DNS server bypasses the firewall NVA.

The correct answer is that traffic to both the database server and the DNS server bypasses the firewall NVA. This occurs because Azure selects routes based on the longest prefix match (LPM) algorithm first. The destination IP of the database server (

10.110.20.5

) matches the system route

10.110.0.0/16

(next hop: Virtual Network) and the UDR

10.0.0.0/8

(next hop: Virtual Appliance). The prefix length of

16

is longer than

8

, so the system route wins, keeping traffic direct. Similarly, the destination IP of the DNS server (

10.100.2.10

) matches the peering system route

10.100.0.0/16

(next hop: VNet Peering) and the UDR

10.0.0.0/8

. The prefix length of

16

is longer than

8

, so the peering system route wins, bypassing the firewall NVA.

Step-by-Step Solution

Evaluate the destination IP address for the database server and compare matching route prefixes.

For the database server at

10.110.20.5

, the matching routes are the local system route

10.110.0.0/16

(next hop: Virtual Network) and the UDR

10.0.0.0/8

(next hop: Virtual Appliance).

Azure routing uses the longest prefix match (LPM) algorithm to determine the winning route.

Select the winning route for the database server destination.

The local system route

10.110.0.0/16

has a longer prefix length (

16

) than the UDR

10.0.0.0/8

(

8

). Therefore, the system route is selected, keeping the traffic direct and bypassing the NVA.

A more specific prefix (longer subnet mask) takes precedence over a less specific prefix.

Evaluate the destination IP address for the DNS server and compare matching route prefixes.

For the DNS server at

10.100.2.10

, the matching routes are the peering system route

10.100.0.0/16

(next hop: VNet Peering) and the UDR

10.0.0.0/8

(next hop: Virtual Appliance).

LPM must be applied to determine if the peering route or the UDR is selected.

Select the winning route for the DNS server destination.

The peering system route

10.100.0.0/16

has a longer prefix length (

16

) than the UDR

10.0.0.0/8

(

8

). Therefore, the peering route is selected, causing traffic to bypass the NVA.

Like the local route, the peering system route is more specific than the UDR.

Key Concept

Azure Virtual Network routing uses the longest prefix match algorithm to select routes. User-defined routes only override system routes of the exact same prefix length; a more specific system route will always take precedence over a broader user-defined route.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic