Examkin

Soru

Zorluk: ZorConfigure Virtual Network Peering

An administrator is designing a hub-and-spoke network topology in Azure using the following virtual networks in the East US region:
* VNet-Hub (10.100.0.0/1610.100.0.0/16): Contains a virtual network gateway in a subnet named GatewaySubnet, and a Network Virtual Appliance (NVA) in a subnet named DMZSubnet.
* VNet-SpokeA (10.101.0.0/1610.101.0.0/16): Contains a virtual machine named VM-App in a subnet named AppSubnet.
* VNet-SpokeB (10.102.0.0/1610.102.0.0/16): Contains a virtual machine named VM-DB in a subnet named DBSubnet.

The administrator establishes the following virtual network peering connections:
* Peering-Hub-SpokeA from VNet-Hub to VNet-SpokeA
* Peering-SpokeA-Hub from VNet-SpokeA to VNet-Hub
* Peering-Hub-SpokeB from VNet-Hub to VNet-SpokeB
* Peering-SpokeB-Hub from VNet-SpokeB to VNet-Hub

The administrator has configured user-defined routes (UDRs) on AppSubnet and DBSubnet to route traffic between the spokes through the NVA in VNet-Hub.

The administrator must meet the following requirements:
1. VM-App must be able to access on-premises networks via the virtual network gateway in VNet-Hub.
2. VM-App and VM-DB must be able to communicate with each other through the NVA in VNet-Hub.
3. VM-DB must be prevented from using the virtual network gateway in VNet-Hub.

Which configuration settings should the administrator apply to the peering connections to meet these requirements?

  1. A
    Enable Allow gateway transit on both Peering-Hub-SpokeA and Peering-Hub-SpokeB; and enable both Use remote gateways and Allow forwarded traffic on Peering-SpokeA-Hub and Peering-SpokeB-Hub.
  2. Enable Allow gateway transit on Peering-Hub-SpokeA; enable Use remote gateways and Allow forwarded traffic on Peering-SpokeA-Hub; and enable Allow forwarded traffic and disable Use remote gateways on Peering-SpokeB-Hub.Cevap
  3. C
    Enable Use remote gateways on Peering-Hub-SpokeA; enable Allow gateway transit and Allow forwarded traffic on Peering-SpokeA-Hub; and enable Allow forwarded traffic and Allow gateway transit on Peering-SpokeB-Hub.
  4. D
    Enable Allow gateway transit on both Peering-Hub-SpokeA and Peering-Hub-SpokeB; and disable both Use remote gateways and Allow forwarded traffic on Peering-SpokeA-Hub and Peering-SpokeB-Hub.

Cevap

The correct configuration requires enabling Allow gateway transit on the Hub-to-SpokeA peering, enabling Use remote gateways and Allow forwarded traffic on the SpokeA-to-Hub peering, and enabling Allow forwarded traffic while disabling Use remote gateways on the SpokeB-to-Hub peering.
To satisfy the requirements, the peering connection from the hub to VNet-SpokeA must permit gateway sharing (Allow gateway transit) and the spoke-to-hub peering must accept it (Use remote gateways). For spoke-to-spoke communication via the Network Virtual Appliance (NVA) in the hub, both VNet-SpokeA and VNet-SpokeB peering connections to VNet-Hub must allow forwarded traffic, as packets routed between them will originate from outside the hub's address space. Finally, to prevent VNet-SpokeB from using the gateway, Use remote gateways must be disabled on the VNet-SpokeB to VNet-Hub peering.

Adım Adım Çözüm

1
Configure the peering connection to support gateway transit for the application virtual network (VNet-SpokeA).
Enable 'Allow gateway transit' on Peering-Hub-SpokeA and 'Use remote gateways' on Peering-SpokeA-Hub.
This allows virtual machines in VNet-SpokeA to route outbound traffic through the virtual network gateway in VNet-Hub.
2
Configure the peering connection to prevent gateway transit for the database virtual network (VNet-SpokeB).
Disable 'Use remote gateways' on Peering-SpokeB-Hub.
This prevents virtual machines in VNet-SpokeB from using the virtual network gateway in VNet-Hub.
3
Configure peering settings to support transit routing via the Network Virtual Appliance (NVA) in VNet-Hub.
Enable 'Allow forwarded traffic' on both Peering-SpokeA-Hub and Peering-SpokeB-Hub.
When traffic between VNet-SpokeA and VNet-SpokeB is routed through the NVA in VNet-Hub, the source IP addresses of the packets do not belong to VNet-Hub. Therefore, the spoke virtual networks must be configured to accept forwarded traffic from VNet-Hub.

Anahtar Kavram

Virtual Network Peering configuration settings including Gateway Transit, Remote Gateways, and Forwarded Traffic for transit routing architectures.
Bu soruyu puanla

Konular

Configure Virtual Network Peering

Bu konudan daha fazla soru