An enterprise is designing a hybrid networking solution in Azure. The architecture include… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hybrid networking solution in Azure. The architecture includes:
- A hub virtual network named `vnet-hub-eus` ( $10.150.0.0/16$ ) that hosts a Virtual Network Gateway connected to an on-premises network.
- A spoke virtual network named `vnet-prod-eus` ( $10.160.0.0/16$ ) containing two subnets: `subnet-web` ( $10.160.1.0/24$ ) and `subnet-app` ( $10.160.2.0/24$ ).
- Virtual network peering configured between `vnet-hub-eus` and `vnet-prod-eus` with gateway transit enabled.

The enterprise has the following requirements:
- All outbound internet traffic from `vnet-prod-eus` must be redirected through the Virtual Network Gateway to the on-premises firewall for inspection.
- All traffic between `subnet-web` and `subnet-app` must route directly between the subnets and must not traverse the gateway or on-premises network.

You need to design a routing solution using a custom Route Table associated with both subnets in `vnet-prod-eus`.
Which route configuration should you specify in the Route Table?

A route for $0.0.0.0/0$ with the next hop type set to Virtual network gateway.Answer
B
A route for $0.0.0.0/0$ with the next hop type set to Virtual network gateway, and a route for $10.160.0.0/16$ with the next hop type set to Virtual network gateway.
C
A route for $0.0.0.0/0$ with the next hop type set to Virtual network gateway, and a route for $10.160.0.0/16$ with the next hop type set to None.
D
A route for $0.0.0.0/0$ with the next hop type set to Virtual network gateway, and a route for $10.160.1.0/24$ with the next hop type set to Virtual network gateway.

Answer

A route for

0.0.0.0/0

with the next hop type set to Virtual network gateway.

Defining only a default route (

0.0.0.0/0

) pointing to the Virtual Network Gateway implements forced tunneling for all internet-destined traffic. Under Azure's longest prefix match algorithm, the system route for local VNet traffic (

10.160.0.0/16

with next hop 'Local') is more specific than the default route (

0.0.0.0/0

). Therefore, traffic between local subnets continues to route directly within the VNet without traversing the gateway, perfectly satisfying all requirements.

Step-by-Step Solution

Analyze Azure's default routing behavior for virtual networks.

By default, Azure creates system routes for local virtual network communication (such as

10.160.0.0/16

to next hop Local) and direct internet access (

0.0.0.0/0

to next hop Internet).

Understanding system routes is necessary to determine what custom routes (User-Defined Routes) must be added and what system routes should be left unchanged.

Address the forced tunneling requirement for outbound internet traffic.

A custom route for

0.0.0.0/0

(the default route representing all internet-bound traffic) is added to the Route Table with the next hop set to Virtual network gateway.

This route overrides the default system route for internet traffic, redirecting it to the gateway and onward to the on-premises firewall.

Evaluate the routing behavior for local traffic between the web and application subnets under the new Route Table configuration.

Local traffic destined for the

10.160.0.0/16

address space will match the default system route (

10.160.0.0/16

-> Local) because its prefix length is longer and more specific than the default route prefix (

0.0.0.0/0

Since the system route for local traffic is more specific, adding no additional routes for the local VNet prefix ensures local traffic continues to flow directly between subnets without traversing the gateway.

Key Concept

Azure Longest Prefix Match (LPM) routing algorithm and User-Defined Route (UDR) precedence over system routes.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic