Examkin

Soru

Zorluk: OrtaVirtual Network Connectivity and Routing

An enterprise designs a hub-and-spoke network topology in Azure. The topology consists of:
- A hub virtual network named `vnet-weur-hub` (10.100.0.0/1610.100.0.0/16) containing an Azure Firewall with the private IP address 10.100.4.410.100.4.4.
- A spoke virtual network named `vnet-weur-spoke1` (10.101.0.0/1610.101.0.0/16) that contains a subnet named `snet-workload1` (10.101.1.0/2410.101.1.0/24).
- A spoke virtual network named `vnet-weur-spoke2` (10.102.0.0/1610.102.0.0/16) that contains a subnet named `snet-workload2` (10.102.1.0/2410.102.1.0/24).

Both spoke virtual networks are peered directly with the hub virtual network. The security team requires that all traffic destined for the internet and all traffic between the two spoke virtual networks must be routed through the Azure Firewall in the hub. However, traffic between resources within `vnet-weur-spoke1` must remain local and route directly without passing through the firewall.

You need to design a route table for `snet-workload1` that meets these requirements with the minimum number of user-defined routes (UDRs).

Which route configuration should you specify in the route table?

  1. A single route with the address prefix 0.0.0.0/0, next hop type Virtual Appliance, and next hop address 10.100.4.4Cevap
  2. B
    One route with the address prefix 0.0.0.0/0, next hop type Virtual Appliance, next hop address 10.100.4.4; and one route with the address prefix 10.101.0.0/16, next hop type Virtual Appliance, next hop address 10.100.4.4
  3. C
    A single route with the address prefix 10.100.0.0/14, next hop type Virtual Appliance, and next hop address 10.100.4.4
  4. D
    A single route with the address prefix 10.102.0.0/16, next hop type Virtual Network, and next hop address 10.100.4.4

Cevap

A single route with the address prefix 0.0.0.0/0, next hop type Virtual Appliance, and next hop address 10.100.4.4
The correct configuration uses a single route with the prefix 0.0.0.0/0 pointing to the Azure Firewall at 10.100.4.4. Since Azure uses the longest prefix match algorithm, traffic to the local network (10.101.0.0/16) will match the system route and bypass the firewall, whereas inter-spoke and internet traffic will match the default route and go through the firewall.

Adım Adım Çözüm

1
Analyze the prefix matching behavior of Azure routing.
Azure evaluates routing tables using the longest prefix match. The system route for the local virtual network is 10.101.0.0/16.
Understanding how Azure determines path priority is necessary to avoid unnecessary routes.
2
Evaluate the default route (0.0.0.0/0) behavior.
A UDR of 0.0.0.0/0 redirects all traffic not matching a more specific route to the specified next hop (10.100.4.4). Local traffic (10.101.0.0/16) remains direct because 16 is a longer prefix match than 0.
Using 0.0.0.0/0 minimizes the route table complexity while capturing internet and inter-spoke traffic.
3
Determine if additional routes are required for local VNet traffic.
No additional route is required. Adding a local VNet prefix route to the UDR table would override the direct path and force local traffic through the firewall.
This avoids the overlapping route misconception that breaks local VNet traffic.

Anahtar Kavram

Azure routing utilizes the longest prefix match algorithm, allowing broad User Defined Routes like 0.0.0.0/0 to redirect external traffic to virtual appliances without overriding more specific local system routes.

Alternatif Yöntem

While configuring a single 0.0.0.0/0 route is the most optimal approach, an alternative but more complex configuration would involve defining separate routes for internet-bound traffic (0.0.0.0/0) and spoke-bound traffic (10.102.0.0/16) both pointing to the firewall. This achieves the same routing logic but requires maintaining additional routes.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Virtual Network Connectivity and Routing

Bu konudan daha fazla soru