An enterprise is designing a hub-and-spoke virtual network topology in Azure. The topology… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The topology consists of a hub virtual network named `vnet-hub-prod` ( $10.100.0.0/16$ ), a spoke virtual network named `vnet-spoke-app` ( $10.101.0.0/16$ ), and a spoke virtual network named `vnet-spoke-db` ( $10.102.0.0/16$ ). The hub virtual network contains an Azure Firewall deployed at $10.100.2.4$ . Virtual network peering is established between the hub and each spoke virtual network.

The following routing requirements must be met:
- All traffic between `vnet-spoke-app` and `vnet-spoke-db` must transit through the Azure Firewall in the hub.
- All outbound internet traffic from the spokes must be routed through the Azure Firewall.
- Virtual machines within `vnet-spoke-app` must communicate directly with each other without sending traffic to the firewall.

Which of the following routing configurations should you implement to satisfy these requirements? (Select TWO.)

Associate a route table to the subnets in `vnet-spoke-app` containing a route for $10.102.0.0/16$ and a route for $0.0.0.0/0$ , both with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .Answer
Associate a route table to the subnets in `vnet-spoke-db` containing a route for $10.101.0.0/16$ and a route for $0.0.0.0/0$ , both with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .Answer
C
Associate a route table to the subnets in `vnet-spoke-app` containing a route for $10.101.0.0/16$ with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .
D
Associate a route table to the subnets in `vnet-spoke-db` containing a route for $10.102.0.0/16$ with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .

Answer

The correct configurations are to associate a route table to the subnets in the application spoke containing a route for the database prefix and a route for the default route pointing to the firewall IP, and to associate a route table to the subnets in the database spoke containing a route for the application prefix and a route for the default route pointing to the firewall IP.

Routing between spoke virtual networks in a hub-and-spoke architecture requires User Defined Routes (UDRs) because virtual network peering is not transitive. To send traffic from the application spoke to the database spoke, a UDR for the database subnet prefix (

10.102.0.0/16

) pointing to the firewall is required. Similarly, a UDR for the internet destination (

0.0.0.0/0

) pointing to the firewall satisfies the secure egress requirement. The same logic applies in reverse for the database spoke routing to the application spoke. Because local traffic within a spoke relies on the default system route (VnetLocal) which is implicit, leaving the local prefix out of the UDR ensures that intra-VNet communication does not transit the firewall.

Step-by-Step Solution

Identify the address spaces and firewall IP address details.

Hub VNet uses

10.100.0.0/16

, Spoke A uses

10.101.0.0/16

, Spoke B uses

10.102.0.0/16

, and Azure Firewall IP is

10.100.2.4

Establishes the exact prefixes and next-hop parameters needed to define User Defined Routes (UDRs).

Determine the required route table entries for the application spoke.

Create a route table associated with the subnets in the application spoke. Add a route for

10.102.0.0/16

(database spoke) and a route for

0.0.0.0/0

(internet), both pointing to the virtual appliance at

10.100.2.4

. Do not add a route for the local

10.101.0.0/16

range.

This configuration correctly directs inter-spoke and egress traffic to the firewall while allowing local VNet communication to remain direct by utilizing the implicit, lower-priority VnetLocal system route.

Determine the required route table entries for the database spoke.

Create a route table associated with the subnets in the database spoke. Add a route for

10.101.0.0/16

(application spoke) and a route for

0.0.0.0/0

(internet), both pointing to the virtual appliance at

10.100.2.4

. Do not add a route for the local

10.102.0.0/16

range.

This mirroring configuration directs return and egress traffic from the database spoke to the firewall while ensuring local database VMs communicate directly using the VnetLocal system route.

Key Concept

Azure Virtual Network routing priorities dictate that User Defined Routes (UDRs) override system routes. When configuring transit routing through an NVA/Firewall, defining a UDR matching the local virtual network's address space overrides the default VnetLocal system route and disrupts intra-VNet local communications.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic