Examkin

Soru

Zorluk: OrtaVirtual Network Connectivity and Routing

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network is `vnet-hub-prod` (10.10.0.0/1610.10.0.0/16) and hosts an Azure Firewall at 10.10.1.410.10.1.4. The spoke virtual network is `vnet-spoke-app` (10.20.0.0/1610.20.0.0/16) and contains two subnets: `subnet-web` (10.20.1.0/2410.20.1.0/24) and `subnet-db` (10.20.2.0/2410.20.2.0/24). The virtual networks are connected via Virtual Network Peering.

The administrator wants to route all traffic from `subnet-web` to `subnet-db` through the Azure Firewall for security inspection. To achieve this, the administrator creates a route table and associates it with `subnet-web`.

Which route configuration should be added to the route table to inspect traffic destined for `subnet-db` while ensuring that local traffic within `subnet-web` and traffic to other potential subnets in `vnet-spoke-app` continues to route directly within the virtual network?

  1. Address prefix: 10.20.2.0/2410.20.2.0/24; Next hop type: Virtual appliance; Next hop address: 10.10.1.410.10.1.4Cevap
  2. B
    Address prefix: 10.20.0.0/1610.20.0.0/16; Next hop type: Virtual appliance; Next hop address: 10.10.1.410.10.1.4
  3. C
    Address prefix: 10.20.2.0/2410.20.2.0/24; Next hop type: Virtual network gateway; Next hop address: 10.10.1.410.10.1.4
  4. D
    Address prefix: 10.20.0.0/1610.20.0.0/16; Next hop type: VNet peering; Next hop address: None

Cevap

Configure a User Defined Route with an Address prefix of 10.20.2.0/2410.20.2.0/24, Next hop type of Virtual appliance, and Next hop address of 10.10.1.410.10.1.4.
The correct answer specifies a route for the specific database subnet prefix (10.20.2.0/2410.20.2.0/24) with a next hop type of Virtual appliance pointing to the firewall IP (10.10.1.410.10.1.4). By using a more specific prefix, Azure uses Longest Prefix Match (LPM) to route database traffic to the firewall, while traffic within the web subnet or to other subnets continues to use the less-specific system route (10.20.0.0/1610.20.0.0/16 -> Virtual Network).

Adım Adım Çözüm

1
Analyze the destination target prefix requirements.
The target subnet is `subnet-db` (10.20.2.0/2410.20.2.0/24), while the rest of the virtual network is `vnet-spoke-app` (10.20.0.0/1610.20.0.0/16).
Determining the correct prefix prevents over-routing and maintains local virtual network connectivity.
2
Determine the routing priority and longest prefix match (LPM) logic in Azure.
A route targeting 10.20.2.0/2410.20.2.0/24 is more specific than the default local system route of 10.20.0.0/1610.20.0.0/16.
Azure routes traffic using the longest prefix match. A route for 10.20.2.0/2410.20.2.0/24 will only affect traffic going to the database subnet, leaving traffic to 10.20.1.0/2410.20.1.0/24 or other parts of the spoke to follow the system route.
3
Select the correct next hop type and IP address for the firewall.
Next hop type should be Virtual appliance, and the next hop IP address should be the Azure Firewall's private IP (10.10.1.410.10.1.4).
Azure Firewall acts as a network virtual appliance (NVA) and routing to it requires the Virtual appliance next hop type.

Anahtar Kavram

Azure Route Selection and Longest Prefix Match (LPM)
Bu soruyu puanla

Konular

Virtual Network Connectivity and Routing

Bu konudan daha fazla soru