An enterprise is designing a hub-and-spoke virtual network topology in Azure: - The hub vi… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure:
- The hub virtual network, `vnet-hub-weur`, has the address space $10.10.0.0/16$ and hosts an Azure Firewall at $10.10.1.4$ .
- The spoke virtual network, `vnet-spoke-prod`, has the address space $10.20.0.0/16$ and contains a subnet named `snet-app` ( $10.20.1.0/24$ ).
- Virtual network peering is established between `vnet-hub-weur` and `vnet-spoke-prod` with transit enabled.

The enterprise has the following routing requirements for traffic originating from `snet-app`:
1. All traffic destined for the internet must be inspected by the Azure Firewall in `vnet-hub-weur`.
2. All traffic destined for resources in `vnet-hub-weur` must be inspected by the Azure Firewall.
3. Traffic destined for other subnets within `vnet-spoke-prod` must bypass the firewall and route directly.

You need to configure the route table associated with `snet-app` to meet these requirements. Which two route configurations should you add? (Select TWO.)

A route for $0.0.0.0/0$ with a next hop type of `Virtual appliance` and a next hop IP address of $10.10.1.4$ .Answer
A route for $10.10.0.0/16$ with a next hop type of `Virtual appliance` and a next hop IP address of $10.10.1.4$ .Answer
C
A route for $10.20.0.0/16$ with a next hop type of `Virtual appliance` and a next hop IP address of $10.10.1.4$ .
D
A route for $10.20.1.0/24$ with a next hop type of `Virtual network`.

Answer

The correct configurations are to add a route for

0.0.0.0/0

with a next hop of the firewall IP (

10.10.1.4

) and a route for the hub address space (

10.10.0.0/16

) pointing to the same firewall IP.

To route internet traffic to the firewall, you must define a default route of

0.0.0.0/0

pointing to the firewall's private IP address as a virtual appliance. To route traffic destined for the hub virtual network through the firewall instead of the direct peering connection, you must explicitly define a route for the hub IP address range (

10.10.0.0/16

) pointing to the firewall. This is because user-defined routes (UDRs) have higher precedence than system-defined peering routes.

Step-by-Step Solution

Determine the route required to inspect internet-bound traffic.

Create a route for

0.0.0.0/0

with next hop type set to `Virtual appliance` and the next hop IP address set to the firewall IP (

10.10.1.4

This redirects all default traffic (internet) to the firewall instead of using the default system route for the internet.

Determine how to inspect traffic going to the hub virtual network.

Create a route for

10.10.0.0/16

with next hop type set to `Virtual appliance` and the next hop IP address set to the firewall IP (

10.10.1.4

By default, virtual network peering creates a system route for the peered range (

10.10.0.0/16

) with next hop type `VNet peering`. To inspect this traffic, a user-defined route must be created for the same prefix, which takes precedence over the system route.

Evaluate the need for routing within the local spoke virtual network.

Leave local routing to the default system route for the virtual network (

10.20.0.0/16

Azure automatically routes traffic within the same virtual network locally. Creating a user-defined route for the local virtual network range pointing to the firewall would incorrectly intercept intra-spoke traffic, breaking the requirement to bypass the firewall for local communication.

Key Concept

Azure User-Defined Routes (UDR) precedence and path selection in hub-and-spoke topologies.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic