An enterprise deploys a hub-and-spoke virtual network topology in Azure. The hub virtual n… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise deploys a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-core` ( $10.100.0.0/16$ ), contains an Azure Firewall at $10.100.4.4$ . The first spoke virtual network, `vnet-spoke-web` ( $10.110.0.0/16$ ), hosts web servers in a subnet named `snet-web` ( $10.110.1.0/24$ ). The second spoke virtual network, `vnet-spoke-db` ( $10.120.0.0/16$ ), hosts database servers in a subnet named `snet-db` ( $10.120.1.0/24$ ). Both spoke virtual networks are peered directly with the hub virtual network, but they are not peered with each other. To route all egress traffic from `vnet-spoke-web` to the database servers through the Azure Firewall for security inspection, the network architect associates a custom route table named `rt-web-transit` with the `snet-web` subnet. The route table includes a single user-defined route (UDR) with the address prefix $10.0.0.0/8$ and the next hop set to the Azure Firewall ( $10.100.4.4$ ). During testing, VMs in `snet-web` can successfully connect to databases in `snet-db`, but traffic is not logged or inspected by the Azure Firewall. Which configuration change must be made to ensure that traffic from `vnet-spoke-web` to `vnet-spoke-db` is routed through the Azure Firewall?

Add a route to `rt-web-transit` with the address prefix $10.120.0.0/16$ and the next hop set to the Azure Firewall ( $10.100.4.4$ ).Answer
B
Add a route to `rt-web-transit` with the address prefix $10.110.0.0/16$ and the next hop set to the Azure Firewall ( $10.100.4.4$ ), and disable gateway route propagation.
C
Modify the peering connection between `vnet-spoke-web` and `vnet-hub-core` to enable the 'Use remote gateways' option, and enable gateway transit on the hub.
D
Delete the peering connections to the hub, and create a direct virtual network peering between `vnet-spoke-web` and `vnet-spoke-db` with gateway transit enabled.

Answer

Add a route to `rt-web-transit` with the address prefix

10.120.0.0/16

and the next hop set to the Azure Firewall (

10.100.4.4

The correct answer is correct because Azure virtual network peering injects system routes for peered address spaces (in this case,

10.120.0.0/16

with next hop 'VNet Peering'). Azure evaluates matching routes using Longest Prefix Match (LPM). Because the destination database IP matches the

/16

system route, which is a longer prefix than the custom

/8

route (

10.0.0.0/8

), the traffic bypasses the firewall. Adding a UDR that matches the exact prefix (

10.120.0.0/16

) overrides the system route because UDRs take precedence over system routes when prefix lengths are identical.

Step-by-Step Solution

Analyze the destination IP space and active routes on the source subnet.

Traffic from `snet-web` (

10.110.1.0/24

) destined for `vnet-spoke-db` (

10.120.0.0/16

) has two matching routes: the system-defined VNet Peering route (

10.120.0.0/16

) and the custom UDR (

10.0.0.0/8

Identifying all matching routes helps determine which route Azure will select to forward packets.

Evaluate the route selection precedence based on prefix length.

Azure uses Longest Prefix Match (LPM) to select routes. The

/16

system route is more specific than the

/8

user-defined route, so the system route is selected and traffic bypasses the firewall.

Understanding LPM is critical to identifying why the broad UDR fails to intercept peered VNet traffic.

Override the system route with a specific user-defined route.

Add a route with the exact prefix

10.120.0.0/16

pointing to the Azure Firewall (

10.100.4.4

). When prefix lengths are identical, User-Defined Routes take precedence over system routes.

Adding a matching prefix length UDR successfully forces Azure to select the firewall as the next hop.

Key Concept

Azure Routing Selection Rules and Peering Precedence

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic