An enterprise has a hub-and-spoke network topology in Azure to support a multi-tier applic… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise has a hub-and-spoke network topology in Azure to support a multi-tier application. The topology contains the following configurations:

* Hub VNet (`vnet-hub-weur`): Address space $10.100.0.0/16$ . It contains an Azure Route Server and a Network Virtual Appliance (`nva-core` at $10.100.1.4$ ) that dynamically advertises the prefix $192.168.10.0/24$ via BGP.
* Spoke VNet (`vnet-prod-spoke`): Address space $10.101.0.0/16$ . It contains a subnet named `subnet-prod` ( $10.101.1.0/24$ ). The spoke VNet is peered with the hub VNet with gateway transit enabled so that it receives the routes propagated by the Route Server.
* **Security Scanner (`nva-scan` at $10.100.2.4$ )**: Deployed in the hub VNet for inspecting traffic destined to specific security zones.

You need to design a routing solution for resources in `subnet-prod` to ensure that all traffic destined for the $192.168.10.0/24$ network is routed through the security scanner (`nva-scan`) instead of the core NVA (`nva-core`).

Which of the following configurations should you recommend?

Associate a route table with `subnet-prod` and add a user-defined route for $192.168.10.0/24$ with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .Answer
B
Associate a route table with `subnet-prod` and add a user-defined route for $192.168.0.0/16$ with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .
C
Associate a route table with `subnet-prod`, disable gateway route propagation on the route table, and add a user-defined route for $192.168.0.0/16$ with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .
D
Configure a custom routing policy on the Azure Route Server in `vnet-hub-weur` to filter out the BGP advertisement of $192.168.10.0/24$ to `vnet-prod-spoke`.

Answer

Associate a route table with the subnet and add a user-defined route for the exact prefix pointing to the security scanner IP address.

The correct configuration is to associate a route table with the spoke subnet and add a UDR for the exact destination prefix pointing to the security scanner. When Azure evaluates routing options, it first looks at the prefix length (Longest Prefix Match). If the prefix lengths are identical, User-Defined Routes take precedence over BGP routes. Therefore, a UDR for the exact prefix overrides the BGP route propagated by the Route Server.

Step-by-Step Solution

Analyze the existing route sources in the spoke subnet.

The spoke subnet receives a dynamic BGP route for

192.168.10.0/24

pointing to the core NVA (

10.100.1.4

) via Azure Route Server.

Understanding the baseline routing behavior is necessary to design an override mechanism.

Compare routing priority and prefix length rules in Azure.

Azure evaluates routing in order: Longest Prefix Match (LPM) first, and then route source precedence (UDR > BGP > System routes) when prefixes are identical.

This establishes that any override route must have a prefix length at least as specific as

192.168.10.0/24

Select the correct target IP and prefix for the User-Defined Route (UDR).

Creating a UDR for

192.168.10.0/24

pointing to the security scanner (

10.100.2.4

) matches the prefix length and overrides the BGP route due to UDR precedence.

This configuration satisfies the business requirements while adhering to Azure routing rules.

Key Concept

Azure routing precedence and Longest Prefix Match (LPM) for overriding dynamically propagated routes.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic