Examkin

Question

Difficulty: MediumVirtual Network Connectivity and Routing

An enterprise is designing a virtual network routing architecture in Azure to support their workload migration. The architecture consists of a hub virtual network named `vnet-prod-hub` (10.100.0.0/1610.100.0.0/16) that contains a Virtual Network Gateway (`vgw-prod-hub`) in the `GatewaySubnet` (10.100.0.0/2410.100.0.0/24), and a spoke virtual network named `vnet-prod-spoke1` (10.101.0.0/1610.101.0.0/16) hosting an application subnet named `snet-app` (10.101.1.0/2410.101.1.0/24). You need to design a routing solution that forces all internet-bound traffic from the VMs in `snet-app` to go through `vgw-prod-hub` to the on-premises network, while ensuring that VMs within `vnet-prod-spoke1` can communicate directly with each other without routing through the hub. Which two configurations should you include in the design? Select two.

  1. Configure the virtual network peering from `vnet-prod-spoke1` to `vnet-prod-hub` to use the remote virtual network's gateway, and configure the peering from `vnet-prod-hub` to `vnet-prod-spoke1` to allow gateway transit.Answer
  2. Create and associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for 0.0.0.0/00.0.0.0/0 and a next hop type of Virtual network gateway.Answer
  3. C
    Associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for 10.101.0.0/1610.101.0.0/16 and a next hop type of Virtual appliance pointing to the hub gateway.
  4. D
    Associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for the Azure DNS service IP address (168.63.129.16/32168.63.129.16/32) with a next hop type of Virtual network gateway.

Answer

Configure the virtual network peering from the spoke to the hub to use the remote gateway, configure the peering from the hub to the spoke to allow gateway transit, and associate a route table to the application subnet with a route for 0.0.0.0/00.0.0.0/0 pointing to the Virtual network gateway.
To successfully route all internet-bound traffic from a spoke virtual network to an on-premises network via a hub gateway (forced tunneling), you must configure the virtual network peering to allow gateway transit on the hub virtual network and configure the spoke virtual network to use the remote virtual network's gateway. Additionally, you must associate a route table containing a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual network gateway to the spoke subnet to override the default system route that sends internet traffic directly to the internet.

Step-by-Step Solution

1
Enable gateway transit on the virtual network peering link on the hub VNet, and configure the spoke VNet to use the remote gateway.
The spoke virtual network is authorized and configured to route traffic through the Virtual Network Gateway located in the hub virtual network.
This establishes the network path required for the spoke virtual network to access the gateway resource.
2
Create a route table, add a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual network gateway, and associate the route table with the application subnet in the spoke.
The default system route to the Internet is overridden, forcing all internet-bound traffic from the subnet to transit the peered gateway.
By default, Azure routes internet-bound traffic directly to the Internet. A UDR is required to steer this traffic to the gateway.

Key Concept

Forced tunneling in Azure hub-and-spoke topologies requires configuring gateway transit on the peering links and deploying a UDR for 0.0.0.0/00.0.0.0/0 pointing to the Virtual network gateway without overriding local subnet or infrastructure routes.
Rate this question

Topics

Virtual Network Connectivity and Routing

More questions from this topic