Examkin

Question

Difficulty: MediumVirtual Network Connectivity and Routing

An enterprise is planning a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-east-hub` (10.10.0.0/1610.10.0.0/16), contains a Virtual Network Gateway connected to an on-premises network (192.168.1.0/24192.168.1.0/24) via a Site-to-Site VPN. The spoke virtual network, `vnet-east-spoke` (10.20.0.0/1610.20.0.0/16), hosts application virtual machines. You must ensure that all outbound internet traffic from `vnet-east-spoke` is forced to route through the Virtual Network Gateway in `vnet-east-hub` to the on-premises firewall for inspection.

Which two configuration steps should you include in the design?

  1. Configure the virtual network peering connection to allow gateway transit on `vnet-east-hub` and use remote gateways on `vnet-east-spoke`.Answer
  2. Create a route table with a user-defined route for 0.0.0.0/00.0.0.0/0 pointing to the Virtual Network Gateway as the next hop, and associate it with the subnets in `vnet-east-spoke`.Answer
  3. C
    Create a route table with a user-defined route for 0.0.0.0/00.0.0.0/0 pointing to the spoke virtual network address space, and associate it with the GatewaySubnet in `vnet-east-hub`.
  4. D
    Configure a Network Security Group (NSG) in `vnet-east-spoke` with an outbound security rule that permits traffic to the Internet service tag via the VPN Gateway.

Answer

To route all outbound internet traffic from the spoke VNet to the on-premises firewall, you must configure the virtual network peering connection to allow gateway transit on the hub and use remote gateways on the spoke, and create a route table with a user-defined route for 0.0.0.0/00.0.0.0/0 pointing to the Virtual Network Gateway, associating it with the spoke subnets.
To implement forced tunneling from the spoke VNet, you must allow transit across the peered virtual networks and define a custom default route. Configuring the peering to use the remote gateway enables the spoke VNet to access the hub's gateway. Associating a route table to the spoke subnets with a 0.0.0.0/00.0.0.0/0 UDR pointing to the Virtual Network Gateway ensures all outbound internet-bound traffic is forwarded to the hub's gateway rather than egressing directly to the internet.

Step-by-Step Solution

1
Configure virtual network peering settings for gateway transit.
Enable gateway transit on the hub VNet peering side (`vnet-east-hub`) and remote gateway usage on the spoke VNet peering side (`vnet-east-spoke`).
This permits resources in the spoke virtual network to reach and use the VPN gateway located in the hub virtual network.
2
Define custom routing on the spoke subnets.
Create a route table with a default route of 0.0.0.0/00.0.0.0/0 pointing to the Virtual Network Gateway next hop, and associate it with the spoke subnets.
Azure's default system routing sends internet-bound traffic directly to the internet. A UDR is required to override this behavior and force the traffic to the VPN Gateway.

Key Concept

Forced tunneling in Azure hub-and-spoke networks using virtual network peering and user-defined routes.
Estimated Time:1m 30s
Rate this question

Topics

Virtual Network Connectivity and Routing

More questions from this topic