An enterprise is designing a hub-and-spoke virtual network topology in Azure to secure tra… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure to secure traffic between application tiers.

The hub virtual network, `vnet-useast-hub` ( $10.100.0.0/16$ ), hosts an Azure Firewall with the private IP address $10.100.2.4$ .

The app spoke virtual network, `vnet-useast-app` ( $10.101.0.0/16$ ), contains two subnets:
* `web-subnet` ( $10.101.1.0/24$ )
* `api-subnet` ( $10.101.2.0/24$ )

The database spoke virtual network, `vnet-useast-db` ( $10.102.0.0/16$ ), contains one subnet:
* `db-subnet` ( $10.102.1.0/24$ )

Both spoke virtual networks are peered with `vnet-useast-hub`. No direct peering exists between the spokes.

You need to design a routing solution that meets the following requirements:
1. All outbound traffic from `web-subnet` to `db-subnet` must be routed through the Azure Firewall in the hub.
2. All return traffic from `db-subnet` to `web-subnet` must also traverse the Azure Firewall.
3. Traffic between `web-subnet` and `api-subnet` within the app spoke must remain local and route directly without traversing the firewall.

Which of the following configurations should you implement to meet these requirements? (Select TWO.)

Associate a route table with `web-subnet` and add a route for destination $10.102.0.0/16$ with a next hop type of Virtual Appliance and IP address $10.100.2.4$ .Answer
Associate a route table with `db-subnet` and add a route for destination $10.101.1.0/24$ with a next hop type of Virtual Appliance and IP address $10.100.2.4$ .Answer
C
Associate a route table with `web-subnet` and add a route for destination $10.101.0.0/16$ with a next hop type of Virtual Appliance and IP address $10.100.2.4$ .
D
Associate a route table with `web-subnet` and add a route for destination $10.101.2.0/24$ with a next hop type of Virtual Appliance and IP address $10.100.2.4$ .

Answer

To meet the requirements, you must associate a route table with the web subnet containing a route for the database virtual network prefix (

10.102.0.0/16

) pointing to the Azure Firewall (

10.100.2.4

), and associate another route table with the database subnet containing a route for the web subnet prefix (

10.101.1.0/24

) pointing to the Azure Firewall (

10.100.2.4

To route traffic from the web subnet to the database spoke, a route table must be associated with the web subnet that forwards traffic destined for the database address space (

10.102.0.0/16

) to the Azure Firewall (

10.100.2.4

). For return traffic, a corresponding route table must be associated with the database subnet to route traffic destined for the web subnet (

10.101.1.0/24

) back to the Azure Firewall. This ensures bidirectional traffic flows through the firewall without affecting other spoke-to-spoke or internal routes.

Step-by-Step Solution

Determine how to route traffic from the web subnet to the database subnet through the Azure Firewall.

A User-Defined Route (UDR) is needed on `web-subnet` for destination `10.102.0.0/16` with the next hop set to the virtual appliance IP `10.100.2.4`.

Since the app spoke and database spoke are only peered with the hub and not directly with each other, they rely on system routes that do not automatically route through the firewall. A UDR specifically targeting the database subnet's address space redirects this traffic to the firewall.

Determine how to route return traffic from the database subnet back to the web subnet through the Azure Firewall.

A UDR is needed on `db-subnet` for the specific destination `10.101.1.0/24` pointing to the next hop `10.100.2.4`.

Because the firewall is stateful, the return traffic must also traverse the firewall. Routing to the specific subnet prefix `10.101.1.0/24` ensures that only return traffic to the web tier is routed via the firewall, while traffic to other subnets is unaffected.

Verify that local traffic within the app spoke remains direct and local.

Ensure no UDRs are created on `web-subnet` that override the local system route (`10.101.0.0/16` -> Local) or target `10.101.2.0/24` directly.

Azure system routes prioritize the most specific route. If a UDR with `10.101.0.0/16` or `10.101.2.0/24` is associated with `web-subnet` pointing to the firewall, it overrides the default 'Virtual Network' local system routing, causing local traffic to traverse the firewall and violating the constraints.

Key Concept

User-Defined Routes (UDRs) override Azure system routes. In a hub-and-spoke topology, spoke-to-spoke traffic must be explicitly routed through a central network virtual appliance or firewall using UDRs. However, care must be taken not to override the local virtual network system route, which would disrupt direct intra-VNet communication.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic