An organization is designing a hub-and-spoke virtual network topology in Azure to host a m… — Microsoft Azure Solutions Architect (AZ-305)

An organization is designing a hub-and-spoke virtual network topology in Azure to host a multi-tier web application. The topology consists of the following components:

* A hub virtual network named `vnet-eus-hub` ( $10.100.0.0/16$ ) hosting an Azure Firewall at IP address $10.100.10.4$ .
* A production spoke virtual network named `vnet-eus-prod` ( $10.101.0.0/16$ ) peered with the hub virtual network.
* Three subnets inside `vnet-eus-prod`:
* `subnet-web` ( $10.101.1.0/24$ )
* `subnet-app` ( $10.101.2.0/24$ )
* `subnet-db` ( $10.101.3.0/24$ )

The design must satisfy the following routing requirements:
1. All outbound internet traffic from `subnet-web` must be inspected by the Azure Firewall in the hub.
2. All traffic between `subnet-web` and `subnet-app` must be inspected by the Azure Firewall in the hub.
3. Traffic between `subnet-app` and `subnet-db` must bypass the Azure Firewall and remain local within `vnet-eus-prod` to minimize latency.
4. You must minimize administrative overhead and avoid configuring redundant route rules.

Which route table configuration should you implement to meet the requirements?

A
Create a single route table and associate it with all three subnets. Add a route for $0.0.0.0/0$ with next hop Virtual Appliance ( $10.100.10.4$ ), and a route for $10.101.0.0/16$ with next hop Virtual Appliance ( $10.100.10.4$ ).
Create a route table for `subnet-web` with routes for $0.0.0.0/0$ and $10.101.2.0/24$ pointing to Virtual Appliance ( $10.100.10.4$ ). Create a separate route table for `subnet-app` with a route for $10.101.1.0/24$ pointing to Virtual Appliance ( $10.100.10.4$ ). Do not associate a custom route table with `subnet-db`.Answer
C
Create a single route table and associate it with all three subnets. Add a route for $0.0.0.0/0$ with next hop Virtual Appliance ( $10.100.10.4$ ).
D
Create a single route table and associate it with `subnet-web` and `subnet-app`. Add a route for $0.0.0.0/0$ with next hop Virtual Appliance ( $10.100.10.4$ ), and a route for $10.101.0.0/16$ with next hop Virtual Appliance ( $10.100.10.4$ ).

Answer

Create a route table for the web subnet with routes for

0.0.0.0/0

and the application subnet range pointing to the firewall, create a separate route table for the application subnet with a route for the web subnet range pointing to the firewall, and use default system routes for the database subnet.

The correct solution isolates the custom route tables to only the subnets that require traffic redirection, utilizing specific subnets (specifically

10.101.2.0/24

and

10.101.1.0/24

) to route traffic between the web and application tiers through the firewall. Since the database tier does not have a custom route table associated, and no

/16

route is added to the application subnet, traffic between the application and database tiers matches the default system route

10.101.0.0/16

with next hop Local. Because this system route is more specific than the default

0.0.0.0/0

route, traffic between the application and database subnets bypasses the firewall, keeping database traffic local and avoiding high latency.

Step-by-Step Solution

Analyze routing priority rules in Azure Virtual Networks.

User-Defined Routes (UDRs) take precedence over default System Routes when they have matching prefixes. When multiple routes match a destination, Azure selects the route with the Longest Prefix Match (LPM).

Understanding LPM is essential to predict where packets will be forwarded when multiple route prefixes overlap.

Evaluate the requirement for internet traffic from the web subnet.

Adding a route for

0.0.0.0/0

with next hop Virtual Appliance (

10.100.10.4

) to a route table associated with the web subnet directs all internet-bound traffic to the Azure Firewall.

Since the internet system route has a

/0

prefix, the custom

0.0.0.0/0

route overrides it.

Evaluate the requirement for web-to-application traffic.

To route web-to-app traffic through the firewall, the web subnet's route table needs a route for

10.101.2.0/24

pointing to the firewall, and the application subnet's route table needs a route for

10.101.1.0/24

pointing to the firewall.

Without these specific

/24

routes, traffic between the web and application subnets would match the default local system route (

10.101.0.0/16

-> Local) because

/16

is a longer prefix match than

0.0.0.0/0

, bypassing the firewall.

Verify database tier isolation and local routing behavior.

By keeping the database subnet on default system routes and avoiding a broad

10.101.0.0/16

UDR on the application subnet, traffic between the application subnet (

10.101.2.0/24

) and the database subnet (

10.101.3.0/24

) matches the default local route

10.101.0.0/16

with next hop Local.

This keeps database traffic local, bypassing the firewall and avoiding high latency.

Key Concept

User-Defined Routes (UDR) precedence and Longest Prefix Match (LPM) routing in Azure Virtual Networks.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic