An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virt… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-weur-hub` (address space: $10.10.0.0/16$ ), contains:
- An internal Azure Standard Load Balancer with a frontend IP address of $10.10.1.100$ that balances traffic across an active-active pair of network virtual appliances (NVAs).
- An Azure ExpressRoute Gateway in the `GatewaySubnet` ( $10.10.3.0/24$ ) connected to an on-premises network that advertises the IP prefix $172.16.0.0/12$ .

The spoke virtual network, `vnet-prod-spoke` (address space: $10.20.0.0/16$ ), is peered with `vnet-weur-hub` with gateway transit enabled on the hub and remote gateway usage enabled on the spoke. The spoke virtual network contains two subnets:
- `snet-web` ( $10.20.1.0/24$ )
- `snet-data` ( $10.20.2.0/24$ )

You need to design a routing solution for the virtual machines in `snet-web` to satisfy the following requirements:
- All outbound traffic to the internet must pass through the NVAs for security inspection.
- Traffic to the on-premises network must bypass the NVAs and route directly through the ExpressRoute Gateway.
- Traffic between `snet-web` and `snet-data` must remain internal to the spoke virtual network and must not transit the hub or the NVAs.
- The design must minimize administrative overhead and avoid configuring redundant route entries.

Which three configuration actions should you include in the design? (Select three.)

Create a custom route table and associate it with `snet-web`.Answer
In the custom route table, add a route for $0.0.0.0/0$ with the next hop type of Virtual Appliance and the next hop IP address set to $10.10.1.100$ .Answer
Enable gateway route propagation on the custom route table.Answer
D
Disable gateway route propagation on the custom route table.
E
In the custom route table, add a route for $10.20.0.0/16$ with the next hop type of Virtual Appliance and the next hop IP address set to $10.10.1.100$ .
F
In the custom route table, add a route for $172.16.0.0/12$ with the next hop type of Virtual Appliance and the next hop IP address set to $10.10.1.100$ .

Answer

To meet the requirements, you should create a custom route table, associate it with the web subnet, add a user-defined route for the default route pointing to the internal load balancer IP, and ensure that gateway route propagation is enabled on the route table.

To route internet-bound traffic through the firewalls, a custom route table must be created and associated with the web subnet containing a default route (

0.0.0.0/0

) pointing to the internal load balancer's frontend IP. By enabling gateway route propagation, the subnet automatically learns the on-premises route (

172.16.0.0/12

) via the ExpressRoute Gateway. Because of the Longest Prefix Match rule, traffic destined for the on-premises network matches the more specific propagated route and bypasses the NVAs. Meanwhile, intra-virtual-network traffic matches the system-defined local route (

10.20.0.0/16

-> Local), which is also more specific than the default route, ensuring that communication between the subnets remains local.

Step-by-Step Solution

Create a custom route table and associate it with the target subnet.

The subnet is prepared to accept user-defined routes that override default Azure system routing.

This allows applying custom routing rules specifically to the web subnet.

Add a user-defined route for the prefix

0.0.0.0/0

with the next hop type of Virtual Appliance pointing to the internal load balancer's frontend IP (

10.10.1.100

All traffic not matching a more specific route is sent to the load-balanced NVAs.

This ensures that internet-bound traffic is inspected by the firewalls in a highly available active-active configuration.

Ensure gateway route propagation is enabled on the custom route table.

The subnet automatically inherits the

172.16.0.0/12

route from the ExpressRoute Gateway.

By the Longest Prefix Match (LPM) rule, traffic destined for the on-premises network (

172.16.0.0/12

) matches the propagated route rather than the default route (

0.0.0.0/0

), routing directly to the gateway and bypassing the NVAs without administrative overhead.

Leave the local virtual network prefix route (

10.20.0.0/16

-> Local) as a system route without overriding it.

Intra-virtual-network traffic between the web and data subnets remains direct and does not transit the hub.

The system local route is more specific than the default route, ensuring local direct routing is maintained.

Key Concept

Interaction of User-Defined Routes (UDRs), system-defined routes, and BGP-propagated routes using Longest Prefix Match (LPM).

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic