An enterprise is designing an Azure hub-and-spoke virtual network topology to support thei… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing an Azure hub-and-spoke virtual network topology to support their internal workloads. The topology is configured as follows:

* The hub virtual network, `vnet-hub-core`, has an address space of $172.16.0.0/16$ and hosts an Azure Firewall at $172.16.1.4$ .
* A spoke virtual network, `vnet-spoke-app`, has an address space of $172.18.0.0/16$ and contains a subnet named `subnet-app` ( $172.18.1.0/24$ ).
* A second spoke virtual network, `vnet-spoke-shared`, has an address space of $172.19.0.0/16$ .
* Both spoke virtual networks are peered directly with `vnet-hub-core`. Spoke-to-spoke peering is not configured.

To meet corporate security policies, all traffic originating from `subnet-app` that is destined for the Internet, `vnet-spoke-shared`, and `vnet-hub-core` must be routed through the Azure Firewall for inspection.

An administrator associates a route table with `subnet-app` containing the following custom routes:

* Route 1: Address prefix $0.0.0.0/0$ , Next hop: Virtual appliance ( $172.16.1.4$ )
* Route 2: Address prefix $172.16.0.0/12$ , Next hop: Virtual appliance ( $172.16.1.4$ )

Which routing behavior will occur for traffic originating from `subnet-app`?

Traffic destined for the Internet and vnet-spoke-shared will route through the Azure Firewall, but traffic destined for vnet-hub-core will bypass the firewall and route directly through the peering connection.Answer
B
All traffic destined for the Internet, vnet-spoke-shared, and vnet-hub-core will be successfully inspected by the Azure Firewall.
C
Traffic destined for the Internet will route through the Azure Firewall, but traffic destined for vnet-spoke-shared will fail to route because virtual network peering is non-transitive.
D
Traffic destined for vnet-spoke-shared will route through the Azure Firewall, but all outbound Internet traffic will bypass the firewall and go directly to the Internet.

Answer

Traffic destined for the Internet and vnet-spoke-shared will route through the Azure Firewall, but traffic destined for vnet-hub-core will bypass the firewall and route directly through the peering connection.

The correct answer is correct because Azure routing uses the longest prefix match (LPM) rule. For traffic destined to the hub virtual network (172.16.0.0/16), the system route created by the virtual network peering (172.16.0.0/16) is a longer match (/16) than the user-defined route (172.16.0.0/12, which is /12). Therefore, the system route is preferred, and the traffic bypasses the firewall. For traffic destined to the second spoke (172.19.0.0/16), the system route for the peered hub does not match, so the user-defined route of 172.16.0.0/12 is the longest matching route and sends the traffic to the firewall.

Step-by-Step Solution

Identify the system routes automatically generated for subnet-app in vnet-spoke-app.

The system routes include 172.18.0.0/16 (Local), 172.16.0.0/16 (VNet Peering to vnet-hub-core), and 0.0.0.0/0 (Internet). No route exists for 172.19.0.0/16 because peering is non-transitive.

Understanding system-defined routing is required before evaluating how custom user-defined routes (UDRs) modify behavior.

Evaluate the routing path for traffic destined for vnet-hub-core (172.16.0.0/16) by comparing route prefix lengths.

The destination matches both the system route 172.16.0.0/16 and the UDR 172.16.0.0/12. Since /16 is a longer prefix match than /12, the system route is preferred.

Azure routing utilizes Longest Prefix Match (LPM) to determine the next hop when multiple routes match a destination.

Evaluate the routing path for traffic destined for vnet-spoke-shared (172.19.0.0/16).

The destination matches the UDR 172.16.0.0/12 and UDR 0.0.0.0/0. The system route for the peered hub (172.16.0.0/16) does not match. The longest prefix match is the UDR 172.16.0.0/12, routing traffic to the firewall.

Since peering is non-transitive, no /16 system route exists for the other spoke, allowing the /12 UDR to successfully route this traffic to the firewall.

Key Concept

Azure routing selection prioritizes the longest prefix match (LPM) among all matching routes. A User Defined Route (UDR) with a shorter prefix length than a system-defined route will not override that system route.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic