An administrator is configuring routing and security for a hub-and-spoke virtual network t… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring routing and security for a hub-and-spoke virtual network topology in Microsoft Azure. The topology contains the following networks and subnets:

- A hub virtual network named `VNet-Hub` ( $10.10.0.0/16$ ) containing an Azure Firewall on the subnet `AzureFirewallSubnet`. The firewall has a private IP address of $10.10.1.4$ .
- A spoke virtual network named `VNet-Spoke1` ( $10.20.0.0/16$ ) containing a subnet named `Subnet-Web` ( $10.20.1.0/24$ ).
- A spoke virtual network named `VNet-Spoke2` ( $10.30.0.0/16$ ) containing a subnet named `Subnet-DB` ( $10.30.1.0/24$ ).

Virtual network peering is configured between `VNet-Hub` and `VNet-Spoke1`, and between `VNet-Hub` and `VNet-Spoke2`. Gateway transit is disabled.

You need to meet the following requirements:
1. All traffic from `Subnet-Web` to `Subnet-DB` must be routed through the Azure Firewall and allowed.
2. All outbound HTTPS traffic from `Subnet-Web` to the external partner API endpoint at the fully qualified domain name (FQDN) `api.partner.com` must be allowed.
3. All other traffic must be blocked.

Which two configurations should you perform? (Select two.)

Associate a route table to `Subnet-Web` that contains a route with the address prefix $10.30.0.0/16$ , a next hop type of `Virtual appliance`, and a next hop address of $10.10.1.4$ .Cevap
Create an Application Rule in the Azure Firewall policy that allows HTTPS traffic from $10.20.1.0/24$ to the FQDN `api.partner.com` on port 443.Cevap
C
Associate a route table to `Subnet-Web` that contains a route with the address prefix $10.30.0.0/16$ , a next hop type of `Virtual network gateway`, and a next hop address of $10.10.1.4$ .
D
Configure the virtual network peering connection between `VNet-Spoke1` and `VNet-Hub` to use remote gateways to route traffic transitively to `VNet-Spoke2`.
E
Create an outbound security rule in the Network Security Group (NSG) associated with `Subnet-Web` with a priority of 100 to redirect outbound traffic to the firewall.

Cevap

Associate a route table to the web subnet with a route for the database subnet pointing to the firewall as a virtual appliance, and create an Application Rule to allow HTTPS traffic to the target FQDN.

To route traffic from the web subnet to the database subnet through the firewall, you must associate a route table with the web subnet containing a user-defined route for the database subnet destination (

10.30.0.0/16

), specifying a next hop type of Virtual appliance and the firewall's private IP (

10.10.1.4

). Additionally, to permit outbound HTTPS traffic to the domain name `api.partner.com`, you must configure an Application Rule in the Azure Firewall policy that targets the FQDN over port 443.

Adım Adım Çözüm

Analyze spoke-to-spoke routing requirements.

Confirm that virtual network peering is non-transitive by default, meaning traffic between spoke networks cannot communicate via the hub firewall without a custom route.

Determines that a User-Defined Route (UDR) must be added to route database-bound traffic to the firewall.

Configure the user-defined route in the route table associated with the web subnet.

Define a route targeting the database IP range (

10.30.0.0/16

) with the next hop type set to 'Virtual appliance' and the next hop IP address set to the firewall's private IP (

10.10.1.4

Allows traffic to leave the spoke and be successfully forwarded to the firewall instance for inspection.

Configure outbound FQDN filtering rules on the firewall.

Identify that the destination is a domain name (FQDN) over HTTPS, which requires an Application Rule rather than a Network Rule.

Selects the correct rule type to permit HTTPS traffic to the partner API domain.

Anahtar Kavram

Azure Firewall routing and rule configuration in a hub-and-spoke topology

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru