An administrator configures virtual network routing in an Azure subscription. The subscrip… — Microsoft Azure Administrator (AZ-104)

An administrator configures virtual network routing in an Azure subscription. The subscription contains a virtual network named `VNet-Enterprise` ( $172.20.0.0/16$ ) with three subnets:

* `Subnet-Web` ( $172.20.1.0/24$ )
* `Subnet-App` ( $172.20.2.0/24$ )
* `Subnet-DMZ` ( $172.20.10.0/24$ )

A Network Virtual Appliance (NVA) named `NVA-Firewall` is deployed in `Subnet-DMZ` with the private IP address $172.20.10.10$ . IP forwarding is enabled on the network interface of `NVA-Firewall`.

You create a user-defined route table named `RT-App` and associate it with `Subnet-App`. You configure the following custom routes in `RT-App`:

* Route 1: Address prefix: $172.20.0.0/16$ ; Next hop type: Virtual Appliance; Next hop IP address: $172.20.10.10$
* Route 2: Address prefix: $172.20.1.0/24$ ; Next hop type: Virtual Network

A virtual machine in `Subnet-App` ( $172.20.2.15$ ) attempts to establish connections to a virtual machine in `Subnet-Web` ( $172.20.1.50$ ) and a virtual machine in `Subnet-DMZ` ( $172.20.10.20$ ).

Which routing behavior will occur?

Traffic to $172.20.1.50$ is routed directly via the Virtual Network; traffic to $172.20.10.20$ is routed through `NVA-Firewall`.Cevap
B
Traffic to both $172.20.1.50$ and $172.20.10.20$ is routed through `NVA-Firewall` because the User-Defined Route table overrides default routing.
C
Traffic to $172.20.10.20$ is dropped because routing through a Network Virtual Appliance requires the next hop type to be set to Virtual Network Gateway.
D
Traffic to both destinations is routed directly via the Virtual Network because system routes for the local virtual network cannot be overridden by User-Defined Routes.

Cevap

Traffic to

172.20.1.50

is routed directly via the Virtual Network, while traffic to

172.20.10.20

is routed through `NVA-Firewall`.

The correct answer states that traffic to

172.20.1.50

is routed directly via the Virtual Network, and traffic to

172.20.10.20

is routed through `NVA-Firewall`. For the first destination, Route 2 (

172.20.1.0/24

) is selected over Route 1 (

172.20.0.0/16

) due to the Longest Prefix Match rule, which dictates that more specific prefixes take precedence. For the second destination, only Route 1 matches, and because it is a user-defined route, it overrides the default system route for the virtual network (

172.20.0.0/16

with next hop Virtual Network), sending the traffic to the NVA.

Adım Adım Çözüm

Analyze the destination IP addresses and identify matching prefixes in the route table `RT-App`.

Identify that

172.20.1.50

matches both Route 1 (

172.20.0.0/16

) and Route 2 (

172.20.1.0/24

), while

172.20.10.20

only matches Route 1 (

172.20.0.0/16

Azure route selection evaluates all matching prefixes in the associated route table first.

Apply the Longest Prefix Match (LPM) rule for the destination IP

172.20.1.50

Route 2 (

172.20.1.0/24

) has a longer matching prefix than Route 1 (

172.20.0.0/16

). The next hop of Route 2 is 'Virtual Network', meaning the traffic bypasses the NVA and is routed directly.

When multiple routes match a destination, Azure selects the route with the most specific (longest) prefix.

Determine the routing path for the destination IP

172.20.10.20

Only Route 1 (

172.20.0.0/16

) matches. Since Route 1 is a User-Defined Route, it overrides the system route for the virtual network (which also has a prefix of

172.20.0.0/16

). Because IP forwarding is enabled on `NVA-Firewall`, the packet is routed through the NVA.

User-Defined Routes (UDRs) override default system routes with the same prefix length when they are associated with the subnet.

Anahtar Kavram

Route selection in Azure follows the Longest Prefix Match (LPM) rule, and User-Defined Routes (UDRs) override default system routes of the same prefix length.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular