Examkin

Question

Difficulty: EasyVirtual Network Connectivity and Routing

Your company has an Azure environment with a hub virtual network named `vnet-hub-core` (10.10.0.0/1610.10.0.0/16) and a spoke virtual network named `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16). The virtual networks are peered. A firewall is deployed in the hub virtual network with the private IP address 10.10.1.410.10.1.4. You are configuring a route table for the subnets in `vnet-prod-spoke` to ensure all internet-bound traffic is routed through the firewall in the hub. Which route should you add to the route table to meet this requirement without breaking local communication within the spoke virtual network?

  1. A route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4Answer
  2. B
    A route with address prefix 10.20.0.0/1610.20.0.0/16, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4
  3. C
    A route with address prefix 10.10.0.0/1610.10.0.0/16, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4
  4. D
    A route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual network gateway, and next hop IP address 10.10.1.410.10.1.4

Answer

A route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4
The correct option is the route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4. This configuration directs all traffic destined for the internet through the Azure Firewall in the hub virtual network. Because Azure uses Longest Prefix Match (LPM), the default local system route for the spoke (10.20.0.0/1610.20.0.0/16) will take precedence for internal traffic, leaving local subnet-to-subnet communication intact.

Step-by-Step Solution

1
Identify the target destination for internet-bound traffic.
The target destination prefix for all internet-bound traffic is 0.0.0.0/00.0.0.0/0.
In IP routing, 0.0.0.0/00.0.0.0/0 represents the default route, which matches any destination address not covered by other routing entries.
2
Determine the next hop type and IP address of the firewall virtual appliance.
The next hop type is Virtual appliance, and the next hop IP address is 10.10.1.410.10.1.4.
Azure Firewall acts as a network virtual appliance, so traffic must be directed to its private IP address in the hub.
3
Verify that local communication within the spoke virtual network is preserved.
The route table will contain the custom default route (0.0.0.0/00.0.0.0/0), but the system route for 10.20.0.0/1610.20.0.0/16 remains active.
Azure uses Longest Prefix Match (LPM) routing. The local system route (10.20.0.0/1610.20.0.0/16) has a longer prefix than the custom default route (0.0.0.0/00.0.0.0/0), ensuring internal spoke traffic stays local.

Key Concept

Azure User-Defined Routes (UDR) and Longest Prefix Match (LPM) routing rules.
Rate this question

Topics

Virtual Network Connectivity and Routing

More questions from this topic