A cloud architect is planning a secure Azure network topology for a multi-tier application… — Microsoft Azure Solutions Architect (AZ-305)

A cloud architect is planning a secure Azure network topology for a multi-tier application environment. The infrastructure consists of:

- A hub virtual network named `vnet-transit-hub-weur` ( $10.240.0.0/16$ ) hosting an Azure Firewall ( $10.240.1.4$ ) in `AzureFirewallSubnet` and an Azure Virtual Network Gateway in `GatewaySubnet`.
- A production application spoke virtual network named `vnet-prod-app-weur` ( $10.241.0.0/16$ ).
- A shared database spoke virtual network named `vnet-shared-db-weur` ( $10.242.0.0/16$ ).
- Virtual network peering connections linking the hub to each spoke virtual network.

The design must satisfy the following requirements:
- All traffic between `vnet-prod-app-weur` and `vnet-shared-db-weur` must pass through the Azure Firewall for inspection.
- VMs in both spokes must maintain access to the on-premises datacenter via the central Virtual Network Gateway.
- Local traffic within each spoke virtual network must remain local and bypass the hub.

Which two configurations should the architect recommend to satisfy these requirements? (Select two.)

Associate a route table with the subnets in `vnet-prod-app-weur` that contains a route for $10.242.0.0/16$ with the next hop set to the Azure Firewall private IP address.Answer
Enable gateway transit on the virtual network peering settings for `vnet-transit-hub-weur`, and configure both spoke virtual networks to use the remote virtual network's gateway.Answer
C
Associate a route table with the subnets in `vnet-prod-app-weur` that contains a route for $10.241.0.0/16$ with the next hop set to the Azure Firewall private IP address.
D
Associate a route table with the subnets in `vnet-shared-db-weur` that contains a route for $10.242.0.0/16$ with the next hop set to the Azure Firewall private IP address.

Answer

The correct configurations are to associate a route table with the subnets in the production spoke containing a route for the database spoke's IP range pointing to the Azure Firewall, and to configure virtual network peering to allow gateway transit on the hub while configuring the spokes to use the remote gateway.

To route traffic between the spokes through the hub firewall, a user-defined route (UDR) must be added to the spoke subnets. The route in the production spoke must target the database spoke address space (

10.242.0.0/16

) and use the Azure Firewall (

10.240.1.4

) as the next hop. To enable spoke traffic to reach the on-premises network, virtual network peering gateway transit must be configured. This requires enabling gateway transit on the hub peering and configuring the spoke peerings to use the remote virtual network's gateway.

Step-by-Step Solution

Determine the required route for spoke-to-spoke traffic.

A route for the destination spoke (

10.242.0.0/16

) pointing to the Azure Firewall (

10.240.1.4

) must be added to the source spoke's subnet.

By default, Azure peerings do not transitively route spoke-to-spoke traffic. User-defined routes are required to redirect destination traffic through the hub firewall.

Ensure local subnet routing is preserved.

Avoid defining routes that match the local virtual network's address space (

10.241.0.0/16

on the production spoke, or

10.242.0.0/16

on the database spoke).

Routing the local prefix to a virtual appliance overrides the default local system route, disrupting intra-VNet and intra-subnet communication.

Configure gateway sharing across peerings.

Select 'Allow gateway transit' on the hub virtual network peering and 'Use the remote virtual network's gateway or Route Server' on the spoke side peerings.

This allows VMs in the spoke virtual networks to leverage the Virtual Network Gateway in the hub for hybrid connectivity.

Key Concept

Configuring User-Defined Routes (UDRs) and Peering Gateway Transit in Azure Hub-and-Spoke Topologies

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic