An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual netw… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-useast-hub` ( $10.100.0.0/16$ ), contains an Azure Firewall deployed at $10.100.3.4$ in the `AzureFirewallSubnet` ( $10.100.3.0/24$ ). The spoke virtual network, `vnet-useast-prod` ( $10.101.0.0/16$ ), contains two subnets: `snet-prod-web` ( $10.101.1.0/24$ ) and `snet-prod-db` ( $10.101.2.0/24$ ). The two virtual networks are peered. You need to design a routing solution for the route table associated with `snet-prod-web` to meet the following requirements:
- All traffic destined for the internet must be routed through the Azure Firewall.
- All traffic destined for `snet-prod-db` must be routed through the Azure Firewall.
- Traffic between virtual machines within the same `snet-prod-web` subnet must bypass the Azure Firewall and communicate directly.
- The configuration must minimize administrative maintenance when new subnets are added to `vnet-useast-prod` in the future.

Which configuration should you use for the route table associated with `snet-prod-web`?

A route for $0.0.0.0/0$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; a route for $10.101.0.0/16$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; and a route for $10.101.1.0/24$ with a next hop type of Virtual Network.Answer
B
A route for $0.0.0.0/0$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; and a route for $10.101.0.0/16$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ .
C
A route for $0.0.0.0/0$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; and a route for $10.101.2.0/24$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ .
D
A route for $0.0.0.0/0$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; and a route for $10.101.0.0/16$ with a next hop type of Virtual Network.

Answer

The configuration containing a route for

0.0.0.0/0

pointing to the Virtual Appliance, a route for

10.101.0.0/16

pointing to the Virtual Appliance, and a route for

10.101.1.0/24

pointing to Virtual Network.

In Azure routing, if you define a User Defined Route (UDR) that overlaps with the system-defined local virtual network route (such as

10.101.0.0/16

), the UDR will override the system route. To prevent intra-subnet traffic (

10.101.1.0/24

) from being sent to the firewall, you must define a more specific route for the local subnet with a next hop type of Virtual Network. Because Azure routing uses the Longest Prefix Match (LPM) algorithm, traffic destined for the local subnet (

10.101.1.0/24

) matches the

/24

route and is routed directly within the virtual network. Traffic destined for other subnets in the VNet (e.g.,

10.101.2.0/24

) or future subnets will match the

/16

route and be sent to the Azure Firewall. Internet traffic will match the

0.0.0.0/0

route and also go to the firewall. This minimizes administrative overhead because adding new subnets does not require updating the route table.

Step-by-Step Solution

Analyze Azure routing precedence and Longest Prefix Match (LPM) behavior.

Azure routes traffic based on the most specific prefix (longest prefix match). When two routes have the same prefix, User-Defined Routes (UDRs) override system routes.

We must understand how to override the system-defined VNet route (

10.101.0.0/16

) while preserving local subnet routing.

Design routes to force internet and cross-subnet traffic through the firewall.

Add a default route (

0.0.0.0/0

) pointing to the firewall (

10.100.3.4

) and a VNet-wide route (

10.101.0.0/16

) pointing to the firewall.

This sends all external traffic and any traffic destined for other subnets in the spoke VNet to the firewall.

Introduce a more specific route for the local subnet to prevent intra-subnet traffic from being diverted.

Add a route for

10.101.1.0/24

with the next hop type set to Virtual Network.

Since

/24

is more specific than

/16

, VMs in the same subnet will communicate directly using the Virtual Network next hop, preventing local connectivity failure.

Key Concept

Azure User-Defined Routing (UDR) and Longest Prefix Match (LPM) overriding system routes

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic