An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virt… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-core` ( $10.10.0.0/16$ ), hosts an Azure Firewall at $10.10.4.4$ and an ExpressRoute Virtual Network Gateway. The ExpressRoute gateway connects to the on-premises network ( $192.168.0.0/16$ ) and receives a default route ( $0.0.0.0/0$ ) via BGP to force-tunnel all internet traffic to the on-premises security appliance. A spoke virtual network, `vnet-prod-spoke` ( $10.20.0.0/16$ ), hosts a web application in `snet-web` ( $10.20.1.0/24$ ) and a database in `snet-db` ( $10.20.2.0/24$ ). You need to design a routing solution for `snet-web` to meet the following requirements:
- All traffic to other spoke virtual networks (which use the $10.0.0.0/8$ address space) and the on-premises network must be routed through the Azure Firewall.
- Web servers in `snet-web` must communicate directly with the database in `snet-db` without passing through the Azure Firewall to minimize latency.
- All internet-bound traffic must be forced to the on-premises network via the ExpressRoute gateway.

Which route table configuration should you associate with `snet-web`?

Associate a route table with gateway route propagation enabled. Add user-defined routes (UDRs) for $10.0.0.0/8$ and $192.168.0.0/16$ with a next hop of Virtual Appliance pointing to the Azure Firewall ( $10.10.4.4$ ).Answer
B
Associate a route table with gateway route propagation enabled. Add user-defined routes (UDRs) for $10.20.0.0/16$ , $10.0.0.0/8$ , and $192.168.0.0/16$ with a next hop of Virtual Appliance pointing to the Azure Firewall ( $10.10.4.4$ ).
C
Associate a route table with gateway route propagation disabled. Add user-defined routes (UDRs) for $10.0.0.0/8$ , $192.168.0.0/16$ , and $0.0.0.0/0$ with a next hop of Virtual Appliance pointing to the Azure Firewall ( $10.10.4.4$ ).
D
Associate a route table with gateway route propagation enabled. Add a user-defined route (UDR) for $0.0.0.0/0$ with a next hop of Virtual Appliance pointing to the Azure Firewall ( $10.10.4.4$ ).

Answer

Associate a route table with gateway route propagation enabled. Add user-defined routes (UDRs) for

10.0.0.0/8

and

192.168.0.0/16

with a next hop of Virtual Appliance pointing to the Azure Firewall (

10.10.4.4

The correct configuration uses gateway route propagation to allow the subnet to dynamically learn the default route (

0.0.0.0/0

) advertised by the ExpressRoute gateway from on-premises, satisfying the forced tunneling requirement. By adding UDRs for

10.0.0.0/8

and

192.168.0.0/16

pointing to the Azure Firewall, spoke-to-spoke and on-premises traffic is properly redirected for security inspection. Lastly, because Azure prioritizes routes using Longest Prefix Match (LPM), traffic destined for the database subnet (

10.20.2.0/24

) will match the local VNet system route (

10.20.0.0/16

) rather than the broader UDR (

10.0.0.0/8

), ensuring direct local communication without traversing the firewall.

Step-by-Step Solution

Evaluate the propagation of the default route.

Gateway route propagation must be enabled on the route table so that the subnet learns the BGP route

0.0.0.0/0

from the ExpressRoute Virtual Network Gateway.

This allows internet-bound traffic to be automatically routed to the ExpressRoute gateway for on-premises forced tunneling without needing a manual UDR.

Determine how to route spoke-to-spoke and on-premises traffic to the firewall.

Add user-defined routes (UDRs) for

10.0.0.0/8

and

192.168.0.0/16

with the next hop set to the Azure Firewall IP (

10.10.4.4

This satisfies the security requirement to inspect all cross-virtual network and on-premises traffic using the hub firewall.

Analyze local virtual network routing under Longest Prefix Match (LPM) rules.

For traffic destined to

10.20.2.0/24

(`snet-db`), Azure compares the system route

10.20.0.0/16

(Virtual Network) and the UDR

10.0.0.0/8

(Virtual Appliance). Since

10.20.0.0/16

is the longer prefix match, traffic is routed locally.

This ensures that traffic within the local VNet (`vnet-prod-spoke`) bypasses the firewall and maintains direct communication to minimize latency.

Key Concept

Azure Virtual Network routing priorities, specifically the interaction between User-Defined Routes (UDRs), BGP-propagated routes, and local VNet system routes using Longest Prefix Match (LPM).

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic