An organization is designing a hub-and-spoke network topology in Azure. The hub virtual ne… — Microsoft Azure Solutions Architect (AZ-305)

An organization is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-core` (address space: $10.1.0.0/16$ ), hosts a central network virtual appliance (NVA) at IP address $10.1.1.4$ that provides firewall and inspection services. The spoke virtual network, `vnet-spoke-data` (address space: $10.2.0.0/16$ ), contains two subnets: `snet-db` ( $10.2.1.0/24$ ) hosting database servers, and `snet-app` ( $10.2.2.0/24$ ) hosting application servers. The networks are connected via virtual network peering.

The security policy requires that all outbound internet traffic from the database servers in `snet-db` must be inspected by the hub NVA. However, database servers must communicate directly with application servers in `snet-app` within the same virtual network without routing through the hub NVA, minimizing latency and transaction costs.

To achieve this configuration, a custom route table will be associated with the `snet-db` subnet. Which route configuration should be added to the route table?

A route for $0.0.0.0/0$ with the Next Hop Type set to Virtual Appliance and the Next Hop Address set to $10.1.1.4$ .Answer
B
A route for $10.2.0.0/16$ with the Next Hop Type set to Virtual Appliance and the Next Hop Address set to $10.1.1.4$ , and a default route for $0.0.0.0/0$ to the Internet.
C
Separate routes for each individual public IP address range of the internet destinations with the Next Hop Type set to Virtual Appliance and the Next Hop Address set to $10.1.1.4$ .
D
A route for $0.0.0.0/0$ with the Next Hop Type set to Virtual Appliance pointing to a Basic Load Balancer that distributes traffic to the NVA instances.

Answer

Configure a single route for

0.0.0.0/0

with the Next Hop Type set to Virtual Appliance and the Next Hop Address set to

10.1.1.4

The correct approach is to add a default route for

0.0.0.0/0

pointing to the NVA's IP address. Azure Virtual Network routing uses the Longest Prefix Match (LPM) rule. The system-defined route for the spoke virtual network is

10.2.0.0/16

(Virtual Network). Because the /16 prefix is more specific than the /0 prefix, traffic destined for the local application subnet (

10.2.2.0/24

) will match the system route and bypass the NVA. Traffic destined for the internet, which does not match the local prefix, will fall back to the

0.0.0.0/0

route and go to the NVA.

Step-by-Step Solution

Determine the destination of the traffic that requires custom routing.

Outbound internet traffic corresponds to the address prefix

0.0.0.0/0

The requirement specifies that only traffic destined for the internet must be inspected by the hub NVA.

Analyze how Azure routing matches IP addresses under default settings.

Azure uses Longest Prefix Match (LPM). The local virtual network has a system route for

10.2.0.0/16

LPM ensures that the route with the most specific prefix is selected to forward the packet.

Evaluate the interaction between the system route and the new user-defined route.

Traffic to

10.2.2.0/24

matches the

10.2.0.0/16

route (prefix length /16) instead of

0.0.0.0/0

(prefix length /0).

Since the local virtual network route prefix (/16) is longer than the default route prefix (/0), local traffic stays within the VNet and bypasses the NVA, satisfying both requirements.

Key Concept

Longest Prefix Match in Azure Routing

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic