Examkin

Question

Difficulty: MediumVirtual Network Connectivity and Routing

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-weur` (10.100.0.0/1610.100.0.0/16), hosts an Azure Firewall at 10.100.1.410.100.1.4 and an ExpressRoute gateway. The spoke virtual network, `vnet-prod-weur` (10.101.0.0/1610.101.0.0/16), contains a subnet named `subnet-app` (10.101.1.0/2410.101.1.0/24). The on-premises network uses the IP address space 172.16.0.0/12172.16.0.0/12.

The routing design must meet the following requirements:
1. All internet-bound traffic from `subnet-app` must be routed through the Azure Firewall in the hub.
2. All traffic from `subnet-app` destined for the on-premises network must be routed through the ExpressRoute gateway.
3. Local traffic within `vnet-prod-weur` must bypass the Azure Firewall.

Which two configurations should you recommend to meet these requirements? (Select TWO)

  1. Configure the virtual network peering connection to allow gateway transit on `vnet-hub-weur` and use the remote virtual network's gateway on `vnet-prod-weur`.Answer
  2. In the route table associated with `subnet-app`, add a route for `0.0.0.0/0` with the next hop type set to Virtual appliance and the next hop address set to 10.100.1.410.100.1.4.Answer
  3. C
    In the route table associated with `subnet-app`, add a route for `10.101.0.0/16` with the next hop type set to Virtual appliance and the next hop address set to 10.100.1.410.100.1.4.
  4. D
    In the route table associated with `subnet-app`, add a route for `172.16.0.0/12` with the next hop type set to Virtual network gateway, without configuring gateway transit on the peering connection.

Answer

Configure the virtual network peering connection to allow gateway transit on the hub VNet and use the remote gateway on the spoke VNet, and add a user-defined route for the default route pointing to the Azure Firewall IP in the subnet's route table.
To route internet-bound traffic through the firewall, a route for the default route is required in the route table associated with the subnet. Azure's Longest Prefix Match ensures that the local virtual network route takes precedence over the default route, keeping local traffic local and bypassing the firewall. To connect to the on-premises network via the hub's gateway, gateway transit must be configured on the peering relationship, which makes the gateway route inheritable by the spoke.

Step-by-Step Solution

1
Configure gateway transit on the virtual network peering.
Allows the spoke VNet to access the ExpressRoute gateway in the hub VNet.
By default, virtual network peering is non-transitive. Enabling gateway transit allows resources in the spoke VNet to route traffic through the hub's gateway to on-premises networks.
2
Define the default route in the user-defined route table.
Traffic destined for the internet is sent to the Azure Firewall private IP.
A user-defined route for the default route overrides the default system route for internet traffic, sending it to the firewall for inspection.
3
Rely on system routes and Longest Prefix Match (LPM) for local traffic.
Local traffic within the spoke VNet bypasses the firewall.
Since the local VNet prefix is more specific than the default route, the system route for local traffic remains active and ensures local communication does not route to the firewall.

Key Concept

Hub-and-spoke routing with gateway transit and default route redirection using User-Defined Routes.
Rate this question

Topics

Virtual Network Connectivity and Routing

More questions from this topic