An organization is designing the routing configuration for a spoke virtual network named `… — Microsoft Azure Solutions Architect (AZ-305)

An organization is designing the routing configuration for a spoke virtual network named `vnet-spoke-prod` ( $172.16.0.0/16$ ) in Microsoft Azure. The virtual network contains a subnet named `snet-web` ( $172.16.1.0/24$ ).

`vnet-spoke-prod` is peered with a hub virtual network named `vnet-hub-prod` ( $10.100.0.0/16$ ). The hub virtual network contains an Azure Firewall instance with the private IP address $10.100.1.4$ .

You have the following requirements:
- All outbound traffic from `snet-web` to the internet must be routed through the Azure Firewall for security inspection.
- All traffic from `snet-web` to an external spoke virtual network named `vnet-spoke-corp` ( $192.168.0.0/16$ ) must be routed through the Azure Firewall.
- All internal traffic within `vnet-spoke-prod` must bypass the firewall and route directly between resources using default Azure routing.

Which two routes should you add to the route table associated with `snet-web` to meet these requirements?

A route for $0.0.0.0/0$ with a next hop type of Virtual appliance and next hop IP address of $10.100.1.4$ Answer
A route for $192.168.0.0/16$ with a next hop type of Virtual appliance and next hop IP address of $10.100.1.4$ Answer
C
A route for $172.16.0.0/16$ with a next hop type of Virtual appliance and next hop IP address of $10.100.1.4$
D
A route for $172.16.1.0/24$ with a next hop type of Virtual appliance and next hop IP address of $10.100.1.4$

Answer

To meet the requirements, you must add a route for 0.0.0.0/0 pointing to the Azure Firewall at 10.100.1.4, and a route for 192.168.0.0/16 pointing to the Azure Firewall at 10.100.1.4.

The route for 0.0.0.0/0 directs all outbound internet traffic to the firewall, while the route for 192.168.0.0/16 redirects traffic destined for the corporate spoke virtual network to the firewall. Since Azure routes traffic using the longest prefix match (LPM), local traffic destined for the 172.16.0.0/16 address space will match the default local system route (which is more specific than 0.0.0.0/0) and bypass the firewall, maintaining direct local communication.

Step-by-Step Solution

Configure the internet-bound route.

Add a route for 0.0.0.0/0 with a next hop of Virtual appliance pointing to 10.100.1.4.

This redirects all default traffic (internet-bound) to the firewall for inspection.

Configure the inter-spoke route to the corporate network.

Add a route for 192.168.0.0/16 with a next hop of Virtual appliance pointing to 10.100.1.4.

This ensures traffic destined for the corporate spoke VNet (192.168.0.0/16) is inspected by the firewall before transit.

Allow default local routing to handle intra-VNet traffic.

Do not add any user-defined routes for the local VNet address space 172.16.0.0/16 or subnet 172.16.1.0/24.

Azure automatically evaluates routing using the longest prefix match. The system route for the local VNet (172.16.0.0/16) is more specific than 0.0.0.0/0, ensuring local traffic bypasses the firewall and flows directly. Adding a local UDR would override this system route and break direct local connectivity.

Key Concept

Azure routes traffic using the longest prefix match (LPM) algorithm. System-defined routes for local virtual networks automatically prioritize direct routing over a default route (0.0.0.0/0) unless overridden by a more specific user-defined route (UDR). Overriding the local route space breaks internal communications.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic