An enterprise is designing a routing architecture in Azure. The topology consists of the f… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a routing architecture in Azure. The topology consists of the following components:

* A hub virtual network named `vnet-hub-eus` ( $10.100.0.0/16$ ) that hosts a security Network Virtual Appliance (NVA) at $10.100.1.4$ .
* A spoke virtual network named `vnet-prod-eus` ( $10.110.0.0/16$ ) containing two subnets: `subnet-app` ( $10.110.1.0/24$ ) and `subnet-db` ( $10.110.2.0/24$ ).
* Virtual network peering is established between `vnet-hub-eus` and `vnet-prod-eus` with gateway transit disabled.

The design requires that all traffic from `vnet-prod-eus` to the Internet is routed through the NVA in `vnet-hub-eus` for inspection. However, to minimize latency and costs, traffic between `subnet-app` and `subnet-db` must route directly within the virtual network, bypassing the NVA.

To implement this, an administrator plans to associate a route table with both `subnet-app` and `subnet-db`.

Which route configuration should the administrator define in the route table to satisfy the requirements?

A single route with the address prefix $0.0.0.0/0$ and the next hop type set to Virtual appliance pointing to $10.100.1.4$ Answer
B
A route with the address prefix $0.0.0.0/0$ pointing to $10.100.1.4$ as a Virtual appliance, and a route with the address prefix $10.110.0.0/16$ pointing to $10.100.1.4$ as a Virtual appliance
C
A route with the address prefix $0.0.0.0/0$ pointing to $10.100.1.4$ as a Virtual appliance, and two separate routes with the address prefixes $10.110.1.0/24$ and $10.110.2.0/24$ pointing to the next hop type of Virtual network
D
A single route with the address prefix $0.0.0.0/0$ and the next hop type set to Virtual network gateway

Answer

A single route with the address prefix

0.0.0.0/0

and the next hop type set to Virtual appliance pointing to

10.100.1.4

The correct configuration is to define a single route with the address prefix

0.0.0.0/0

and the next hop type set to Virtual appliance pointing to the NVA's IP address. By default, Azure automatically creates system routes for all subnets in a virtual network. The system route for the local virtual network has the prefix

10.110.0.0/16

with the next hop type set to Virtual network. Under Azure's longest prefix match (LPM) algorithm, any traffic destined for another subnet within the same virtual network (such as from `subnet-app` to `subnet-db`) matches the more specific system route (

10.110.0.0/16

) rather than the default route (

0.0.0.0/0

). Therefore, intra-VNet traffic bypasses the NVA and is routed directly, while all internet-bound traffic (

0.0.0.0/0

) is routed to the NVA.

Step-by-Step Solution

Analyze default system routes in Azure Virtual Networks.

Azure automatically creates a system route for the virtual network prefix (

10.110.0.0/16

) with the next hop set to Virtual network. This route directs traffic between all subnets in the VNet.

Understanding default system routes is necessary to determine how custom routes will interact with standard intra-VNet traffic.

Apply the Longest Prefix Match (LPM) rule.

When a packet is routed, Azure compares the destination IP to all routes in the route table and chooses the route with the longest (most specific) prefix match.

LPM determines which route wins when multiple routes overlap, such as a default route (

0.0.0.0/0

) and a local VNet prefix (

10.110.0.0/16

Evaluate the custom default route configuration.

Adding a UDR for

0.0.0.0/0

pointing to the NVA handles all external/internet traffic. Because the local VNet prefix (

10.110.0.0/16

) is more specific than

0.0.0.0/0

, traffic between the subnets continues to use the system route directly without routing through the NVA.

This satisfies both requirements: internet traffic is inspected by the NVA, while intra-VNet traffic bypasses the NVA without needing redundant rules.

Key Concept

Azure Route Selection and Longest Prefix Match (LPM)

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic