An enterprise designs a virtual network named `vnet-sea-prod` (172.20.0.0/16) to host a tw… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise designs a virtual network named `vnet-sea-prod` ( $172.20.0.0/16$ ) to host a two-tier application. The virtual network contains the following subnets:

* `snet-app` ( $172.20.1.0/24$ ) containing application servers
* `snet-data` ( $172.20.2.0/24$ ) containing database servers
* `snet-shared` ( $172.20.10.0/24$ ) containing a virtual firewall appliance with the IP address $172.20.10.4$

The company's security policy requires that all traffic originating from the application servers in `snet-app` and destined for the database servers in `snet-data` must be inspected by the firewall. However, virtual machines within `snet-app` must be able to communicate directly with each other without routing through the firewall.

You need to design a routing solution that meets these requirements.

Which route should you add to a route table associated with `snet-app`?

A route with the destination prefix $172.20.2.0/24$ and next hop type Virtual appliance pointing to $172.20.10.4$ Cevap
B
A route with the destination prefix $172.20.0.0/16$ and next hop type Virtual appliance pointing to $172.20.10.4$
C
A route with the destination prefix $0.0.0.0/0$ and next hop type Virtual appliance pointing to $172.20.10.4$
D
A route with the destination prefix $172.20.1.0/24$ and next hop type Virtual appliance pointing to $172.20.10.4$

Cevap

A route with the destination prefix

172.20.2.0/24

and next hop type Virtual appliance pointing to

172.20.10.4

The correct route uses the destination prefix

172.20.2.0/24

. Because this prefix is more specific than the default local virtual network route of

172.20.0.0/16

, traffic from the application subnet destined for the database subnet will be directed to the firewall. Since there is no user-defined route for the application subnet itself (

172.20.1.0/24

), traffic between servers in the same subnet will continue to use the system route and flow directly without hitting the firewall, satisfying both requirements.

Adım Adım Çözüm

Analyze Azure's routing evaluation order.

Azure routes traffic based on the Longest Prefix Match (LPM) algorithm and evaluates User-Defined Routes (UDRs) before default system routes of the same prefix length.

To determine how traffic will flow, we must identify the most specific prefix match in the route table for each target destination.

Define the rule for traffic going from the application subnet to the database subnet.

A route targeting

172.20.2.0/24

with the next hop of the firewall (

172.20.10.4

) is more specific than the default

172.20.0.0/16

system route. Traffic to the database subnet will successfully go through the firewall.

This satisfies the security requirement to inspect app-to-database traffic.

Verify that intra-subnet communication is not impacted.

Intra-subnet traffic (destined for

172.20.1.0/24

) will not match the new

172.20.2.0/24

route. Instead, it falls back to the default local system route (

172.20.0.0/16

-> Local), routing directly within the subnet.

This satisfies the requirement that VMs in the application subnet must communicate directly without traversing the firewall.

Anahtar Kavram

Azure User-Defined Routes (UDR) override system routes and are evaluated using Longest Prefix Match (LPM). To steer traffic between specific subnets without disrupting intra-subnet traffic, UDRs should specify the exact destination subnet range rather than the entire virtual network prefix.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru