To meet security compliance requirements, an organization decides to inspect all traffic m… — Microsoft Azure Administrator (AZ-104)

To meet security compliance requirements, an organization decides to inspect all traffic moving between application tiers within a single virtual network. The deployment consists of a virtual network named `VNet-SecureHub` ( $192.168.0.0/16$ ) with three subnets:
* `Subnet-App` ( $192.168.1.0/24$ )
* `Subnet-Appliance` ( $192.168.2.0/24$ )
* `Subnet-Data` ( $192.168.3.0/24$ )

A firewall virtual machine named `FW1` is deployed in `Subnet-Appliance` and is assigned the private IP address $192.168.2.4$ .
You need to ensure that all traffic sent from `Subnet-App` to `Subnet-Data` is routed through `FW1` for inspection.
Which two configuration steps should you perform? (Select two.)

In a route table associated with Subnet-App, configure a route for destination $192.168.3.0/24$ with the next hop type set to Virtual appliance and the next hop IP address set to $192.168.2.4$ .Cevap
Enable IP forwarding on the network interface (NIC) of FW1.Cevap
C
In a route table associated with Subnet-App, configure a route for destination $192.168.3.0/24$ with the next hop type set to Virtual Network Gateway.
D
In a route table associated with Subnet-Appliance, configure a route for destination $192.168.3.0/24$ with the next hop type set to Virtual appliance and the next hop IP address set to $192.168.2.4$ .

Cevap

Configure a user-defined route in a route table associated with the application subnet pointing to the firewall's IP address as a Virtual appliance, and enable IP forwarding on the firewall's network interface.

Routing traffic through an NVA requires overriding system routes by associating a route table with the source subnet. The route must specify the destination IP prefix, use Virtual appliance as the next hop type, and specify the NVA's IP address. Additionally, the NVA's network interface must have IP forwarding enabled so that Azure does not drop packets destined for other IP addresses.

Adım Adım Çözüm

Define a route table and add a route targeting the data subnet.

A route table is created with a route for destination

192.168.3.0/24

, next hop type set to Virtual appliance, and next hop IP address set to

192.168.2.4

Azure system routes route traffic directly between subnets within the same VNet by default. A user-defined route (UDR) is required to override this behavior and force traffic through the firewall.

Associate the route table with the application subnet.

The route table is associated with Subnet-App.

A route table only applies to network traffic originating from resources within a subnet once the route table is explicitly associated with that subnet.

Enable IP forwarding on the network interface (NIC) of FW1.

The network interface of FW1 is configured to allow traffic not destined for its own IP address.

By default, Azure drops traffic sent to a virtual machine if the destination IP address does not match the VM's interface IP. Enabling IP forwarding permits the firewall VM to receive and forward transit traffic.

Anahtar Kavram

Routing subnet traffic through a Network Virtual Appliance (NVA) requires creating a User-Defined Route (UDR) with the Virtual appliance next hop type, associating it with the source subnet, and enabling IP forwarding on the NVA's network interface.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular