Examkin

Soru

Zorluk: OrtaVirtual Network Connectivity and Routing

An enterprise is designing a secure hybrid network topology in Azure. The design includes a hub virtual network named `vnet-hub-prod` (10.50.0.0/1610.50.0.0/16) that contains an Azure VPN Gateway connected to an on-premises datacenter. A spoke virtual network named `vnet-spoke-app` (10.60.0.0/1610.60.0.0/16) is peered with `vnet-hub-prod`. The spoke network contains a subnet named `subnet-app` (10.60.1.0/2410.60.1.0/24).

The enterprise requires that all outbound internet traffic from `subnet-app` is redirected to the on-premises datacenter for security inspection. Resources within `vnet-spoke-app` must retain the ability to communicate directly with each other.

Which three configuration steps should you recommend to meet these requirements?

  1. On the virtual network peering from vnet-hub-prod to vnet-spoke-app, enable the Allow gateway transit option.Cevap
  2. On the virtual network peering from vnet-spoke-app to vnet-hub-prod, enable the Use the remote virtual network's gateway or Route Server option.Cevap
  3. Associate a route table with subnet-app that contains a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual network gateway.Cevap
  4. D
    Associate a route table with subnet-app that contains a route for 10.60.0.0/1610.60.0.0/16 with a next hop type of Virtual network gateway.
  5. E
    Associate a route table with subnet-app that contains a route for 10.50.0.0/1610.50.0.0/16 with a next hop type of Internet.

Cevap

To meet the requirements, you must enable Allow gateway transit on the peering link from the hub, enable Use the remote virtual network's gateway or Route Server on the peering link from the spoke, and associate a route table with the spoke subnet containing a route for 0.0.0.0/00.0.0.0/0 with a next hop type of Virtual network gateway.
To route spoke traffic through a hub gateway, the hub-side peering must have 'Allow gateway transit' enabled, and the spoke-side peering must have 'Use the remote virtual network's gateway or Route Server' enabled. Additionally, to force all internet-bound traffic to on-premises via this gateway, a default route (0.0.0.0/00.0.0.0/0) must be defined in a route table associated with the spoke subnet, with the next hop set to the Virtual network gateway.

Adım Adım Çözüm

1
Enable gateway transit on the hub virtual network peering.
Allows the hub virtual network's VPN gateway to be shared with the peered spoke virtual network.
By default, virtual network peering is non-transitive. Enabling gateway transit allows peered spokes to route traffic through the hub's gateway.
2
Configure the spoke virtual network peering to use the remote gateway.
Permits the spoke virtual network to send and receive traffic via the peered hub's gateway.
This configuration establishes the link necessary for spoke resources to forward traffic to the hub's gateway.
3
Create and associate a route table with the spoke subnet featuring a default route pointing to the gateway.
Forces all outbound internet traffic (0.0.0.0/00.0.0.0/0) to be directed to the VPN gateway (which forwards it to on-premises) while preserving local virtual network routing.
A user-defined route for 0.0.0.0/00.0.0.0/0 with next hop type Virtual network gateway overrides the default Azure system route that sends internet traffic directly to the public internet, satisfying the forced tunneling requirement.

Anahtar Kavram

Forced tunneling and gateway transit in virtual network peering
Bu soruyu puanla

Konular

Virtual Network Connectivity and Routing

Bu konudan daha fazla soru