Examkin

Question

Difficulty: EasyVirtual Network Connectivity and Routing

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` (10.10.0.0/1610.10.0.0/16), hosts a central network virtual appliance (NVA) at IP address 10.10.1.410.10.1.4 to inspect outbound internet traffic. The spoke virtual network, `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16), contains a subnet named `snet-prod-web` (10.20.1.0/2410.20.1.0/24) that hosts web servers. You need to configure the routing so that all outbound internet traffic from `snet-prod-web` is routed through the NVA, while internal communication within the spoke virtual network remains uninterrupted. Which two configurations should you implement? (Select two.)

  1. Associate a route table with the `snet-prod-web` subnet containing a route for `0.0.0.0/00.0.0.0/0` with a next hop type of Virtual Appliance and IP address 10.10.1.410.10.1.4.Answer
  2. Enable the 'Allow forwarded traffic' setting on the virtual network peering connection in `vnet-weur-hub` to accept traffic from the spoke.Answer
  3. C
    Add a route for `10.20.0.0/1610.20.0.0/16` to the spoke's route table with a next hop type of Virtual Appliance pointing to 10.10.1.410.10.1.4.
  4. D
    Configure individual Network Security Group (NSG) rules for every external IP address on the `snet-prod-web` subnet instead of using Service Tags.

Answer

To configure routing through the NVA, associate a route table with the spoke subnet containing a route for all traffic pointing to the NVA as a virtual appliance, and enable the forwarded traffic setting on the peering link to permit transit traffic.
The correct configurations involve creating a route table with a route of `0.0.0.0/00.0.0.0/0` pointing to the NVA's IP (10.10.1.410.10.1.4) as a Virtual Appliance and associating it with the spoke subnet, and configuring the peering connection to allow forwarded traffic. The route table directs all non-local outbound traffic to the NVA. Allowing forwarded traffic on the peering ensures that the hub VNet accepts and routes transit traffic received from the spoke.

Step-by-Step Solution

1
Define a route table for the spoke subnet `snet-prod-web` and add a default route of `0.0.0.0/00.0.0.0/0` directed to the NVA's IP address (10.10.1.410.10.1.4).
Outbound internet traffic from the subnet is directed to the hub's NVA.
By default, Azure routes internet-bound traffic directly to the internet. A User Defined Route (UDR) is required to override this system route.
2
Enable the 'Allow forwarded traffic' configuration on the peering connection between the hub and spoke.
Peering allows packets originating outside the local VNet (the spoke) to be forwarded through the hub VNet.
Without enabling forwarded traffic, Azure's virtual network peering will drop packets where the source IP address does not match the peered network space.

Key Concept

Azure Virtual Network Peering and User Defined Routes (UDR) transit configuration.
Rate this question

Topics

Virtual Network Connectivity and Routing

More questions from this topic