An enterprise is designing a hub-and-spoke network topology in Azure. The topology consist… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure. The topology consists of the following components:
* A hub virtual network named `vnet-neur-hub` ( $10.10.0.0/16$ ) containing an Azure Firewall deployed at IP address $10.10.1.4$ .
* A production spoke virtual network named `vnet-neur-prod` ( $10.20.0.0/16$ ) peered with `vnet-neur-hub`.
* A shared services spoke virtual network named `vnet-neur-shared` ( $10.30.0.0/16$ ) peered with `vnet-neur-hub`.

There is no direct virtual network peering between `vnet-neur-prod` and `vnet-neur-shared`.

You need to implement a routing design that achieves the following objectives:
1. All outbound internet traffic from `vnet-neur-prod` must transit through the Azure Firewall.
2. All traffic from `vnet-neur-prod` destined for `vnet-neur-shared` must transit through the Azure Firewall.
3. All traffic between resources within `vnet-neur-prod` must route directly within the virtual network without traversing the firewall.

Which TWO actions should you perform to configure the route table associated with the subnets in `vnet-neur-prod`?

Add a route for $0.0.0.0/0$ with a next hop of Virtual Appliance and IP address $10.10.1.4$ .Answer
Add a route for $10.30.0.0/16$ with a next hop of Virtual Appliance and IP address $10.10.1.4$ .Answer
C
Add a route for $10.20.0.0/16$ with a next hop of Virtual Appliance and IP address $10.10.1.4$ .
D
Add a route for $10.10.0.0/16$ with a next hop of Virtual Appliance and IP address $10.10.1.4$ .

Answer

To configure routing for the production spoke subnets, you must add a default route of

0.0.0.0/0

pointing to the Azure Firewall private IP address (

10.10.1.4

) as a Virtual Appliance, and add a route for the shared services spoke VNet range (

10.30.0.0/16

) pointing to the same Azure Firewall IP (

10.10.1.4

) as a Virtual Appliance.

To route internet traffic through the firewall, a default route (

0.0.0.0/0

) pointing to the firewall's private IP (

10.10.1.4

) as a Virtual Appliance next hop is required. To route traffic to the peered spoke VNet, a specific route for

10.30.0.0/16

pointing to the firewall's private IP as a Virtual Appliance next hop is required. These custom routes steer external and cross-spoke traffic through the hub firewall without affecting local VNet traffic, which is automatically handled by the system's local route.

Step-by-Step Solution

Determine the route required to direct outbound internet traffic through the central firewall.

Create a route for

0.0.0.0/0

(the default route representing all external traffic) with a next hop of Virtual Appliance pointing to the firewall IP (

10.10.1.4

This satisfies the requirement that all outbound internet traffic from the production spoke VNet must transit through the Azure Firewall.

Determine the route required to enable cross-spoke communication through the firewall.

Create a route for the target shared services spoke range (

10.30.0.0/16

) with a next hop of Virtual Appliance pointing to the firewall IP (

10.10.1.4

Since Azure virtual network peering is non-transitive by default, traffic between two spokes must be explicitly routed through the firewall in the hub VNet.

Evaluate the impact on local VNet traffic within the production spoke.

Do not define any custom routes for the local VNet prefix (

10.20.0.0/16

) in the route table.

Azure automatically manages intra-VNet routing using the default system route (

10.20.0.0/16

-> Local). Adding a custom route for this prefix would override the system route and break direct subnet-to-subnet connectivity.

Key Concept

Configuring custom routing using User Defined Routes (UDRs) in a hub-and-spoke Azure topology while avoiding overlapping routes that override system-defined local paths.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic