An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virt… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-eastus` ( $10.10.0.0/16$ ), hosts an Azure Firewall with the private IP address $10.10.1.4$ . A spoke virtual network, `vnet-prod-spoke` ( $10.20.0.0/16$ ), is peered with the hub virtual network. The enterprise has multiple other spoke virtual networks deployed within the $10.0.0.0/8$ address space.

You need to design a routing solution for `vnet-prod-spoke` that meets the following requirements:
- All traffic destined for the internet must be inspected by the Azure Firewall.
- All traffic destined for other spoke virtual networks within the $10.0.0.0/8$ range must be inspected by the Azure Firewall.
- Traffic between subnets within `vnet-prod-spoke` must route directly between the subnets and bypass the firewall.

Which two routing configurations should you implement in the user-defined route (UDR) table associated with the subnets in `vnet-prod-spoke`? (Select two.)

A route for $0.0.0.0/0$ with the next hop set to the Virtual Appliance IP address $10.10.1.4$ Answer
A route for $10.0.0.0/8$ with the next hop set to the Virtual Appliance IP address $10.10.1.4$ Answer
C
A route for $10.20.0.0/16$ with the next hop set to the Virtual Appliance IP address $10.10.1.4$
D
A route for $10.20.0.0/24$ with the next hop set to the Virtual Appliance IP address $10.10.1.4$

Answer

The correct configurations are to add a route for

0.0.0.0/0

pointing to the Azure Firewall private IP address, and a route for

10.0.0.0/8

pointing to the Azure Firewall private IP address.

To inspect internet-bound traffic, a default route for

0.0.0.0/0

must point to the Azure Firewall private IP address. To inspect spoke-to-spoke traffic without routing internal spoke traffic to the firewall, a user-defined route for the wider

10.0.0.0/8

prefix pointing to the firewall is used. Azure's Longest Prefix Match routing algorithm ensures that local spoke traffic destined for the

10.20.0.0/16

range matches the more specific system route (

10.20.0.0/16

-> Virtual Network) rather than the custom route, allowing local traffic to bypass the firewall.

Step-by-Step Solution

Analyze the traffic requirements and routing precedence in Azure.

Azure routes traffic using the Longest Prefix Match (LPM) algorithm. User-defined routes (UDRs) override system routes of the same prefix length, but a more specific system route will still take precedence over a less specific UDR.

Understanding LPM is critical to designing routes that selectively intercept traffic without overriding necessary local traffic paths.

Evaluate the configuration for internet-bound traffic.

A default route (

0.0.0.0/0

) pointing to the Azure Firewall (

10.10.1.4

) is required to direct all outbound internet traffic to the hub for inspection.

This satisfies the requirement to inspect all internet-bound traffic.

Evaluate the configuration for spoke-to-spoke traffic while preserving local routing.

A route for

10.0.0.0/8

pointing to the Azure Firewall (

10.10.1.4

) directs traffic destined for other virtual networks in that range to the firewall. Since the local spoke virtual network system route (

10.20.0.0/16

) has a longer prefix length than

10.0.0.0/8

, intra-spoke traffic continues to use the system local route, bypassing the firewall.

This satisfies both the spoke-to-spoke inspection requirement and the local spoke bypass requirement.

Key Concept

Azure routing priority and Longest Prefix Match (LPM) interaction with User Defined Routes (UDR).

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic