Examkin

Question

Difficulty: HardVirtual Network Connectivity and Routing

An enterprise deploys a hub-and-spoke virtual network topology in Azure. The Hub Virtual Network (vnet-hub-prod, CIDR: 10.200.0.0/16) contains a subnet (snet-hub-nva, CIDR: 10.200.1.0/24) that hosts a firewall Network Virtual Appliance (NVA) at IP address 10.200.1.4. The Spoke Virtual Network (vnet-spoke-app, CIDR: 10.201.0.0/16) contains a subnet (snet-app-prod, CIDR: 10.201.1.0/24) hosting application servers. The virtual networks are peered.

The enterprise has the following requirements:
1. All outbound internet traffic from snet-app-prod must be routed through the NVA at 10.200.1.4 for security inspection.
2. Application servers in snet-app-prod must communicate directly with database servers in another subnet (snet-app-db, CIDR: 10.201.2.0/24) within the same virtual network without traversing the NVA, to minimize latency.
3. Access to public Azure Key Vault instances must go directly over the Azure backbone network using service tags.

A junior administrator creates a custom Route Table, associates it with snet-app-prod, and defines the following user-defined routes (UDRs):
- Route 1: Address prefix 0.0.0.0/0 -> Next hop: Virtual appliance (10.200.1.4)
- Route 2: Address prefix 10.201.0.0/16 -> Next hop: Virtual appliance (10.200.1.4)
- Route 3: Address prefix AzureKeyVault (Service Tag) -> Next hop: Internet

Following this configuration, application servers in snet-app-prod lose all connectivity to database servers in snet-app-db.

Which modification to the Route Table will restore the required network connectivity?

  1. A
    Change the address prefix of Route 2 to 10.200.0.0/15 to cover all internal networks while leaving the local virtual network address space unaffected.
  2. B
    Delete Route 3 and configure individual Network Security Group rules with specific public IP addresses for each Azure Key Vault endpoint to allow direct outbound access.
  3. Delete Route 2 from the Route Table so that traffic within the virtual network is handled by the default system-defined local route.Answer
  4. D
    Modify the next hop of Route 1 to point to the frontend private IP address of a Basic SKU Load Balancer that load balances a pool of network virtual appliances.

Answer

Delete the user-defined route with the prefix 10.201.0.0/16 (Route 2) from the Route Table so that traffic within the virtual network is handled by the default system-defined local route.
Deleting the user-defined route with the prefix 10.201.0.0/16 allows the default system-defined local virtual network route to handle traffic within the virtual network. In Azure, UDRs with the exact same prefix as system routes will override them. Removing this route allows servers in the application subnet to communicate directly with the database subnet without going through the NVA, satisfying the latency constraint while keeping the security rules for internet and Key Vault traffic intact.

Step-by-Step Solution

1
Analyze the current route table configuration and identify conflicts with requirements.
Route 2 has the address prefix 10.201.0.0/16, which matches the local virtual network's CIDR block.
Identify why traffic from the application subnet to the database subnet within the same virtual network is failing.
2
Evaluate the route selection logic in Azure.
User-defined routes (UDRs) with the same prefix length as system routes override the default system routes. Thus, Route 2 overrides the default '10.201.0.0/16 -> Local' route.
Determine how Route 2 affects traffic destined for resources inside the same virtual network.
3
Formulate a resolution that satisfies all design constraints.
By deleting Route 2, the system route '10.201.0.0/16 -> Local' becomes active again, allowing intra-virtual network traffic to bypass the NVA. Outbound internet traffic and Key Vault traffic still match Route 1 and Route 3 respectively.
Restore the default system local route while preserving forced tunneling for internet traffic and direct path access for Azure Key Vault.

Key Concept

Azure Route Selection and User Defined Route (UDR) Override Behaviors
Estimated Time:2m 0s
Rate this question

Topics

Virtual Network Connectivity and Routing

More questions from this topic