An enterprise is designing a hub-and-spoke virtual network topology in Azure. The transit … — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The transit hub virtual network, `vnet-hub-transit` ( $172.16.0.0/16$ ), contains a firewall subnet, `AzureFirewallSubnet` ( $172.16.0.0/24$ ), hosting an Azure Firewall with a private IP address of $172.16.0.4$ . The application virtual network, `vnet-spoke-app` ( $172.17.0.0/16$ ), is peered with `vnet-hub-transit` and contains two subnets: `snet-web` ( $172.17.1.0/24$ ) and `snet-biz` ( $172.17.2.0/24$ ). Another virtual network, `vnet-spoke-db` ( $172.18.0.0/16$ ), contains the database tier and is also peered with `vnet-hub-transit`.

You need to configure a route table associated with `snet-web`. The routing configuration must meet the following requirements:
- Route all outbound internet traffic from `snet-web` through the Azure Firewall.
- Route all database-bound traffic from `snet-web` to `vnet-spoke-db` through the Azure Firewall.
- Ensure that VMs within `snet-web` can communicate directly with VMs in `snet-biz` without routing traffic through the firewall.

Which route configuration should you apply to the route table associated with `snet-web`?

A
A route for $0.0.0.0/0$ pointing to the virtual appliance at $172.16.0.4$ , and a route for $172.17.0.0/15$ pointing to the virtual appliance at $172.16.0.4$ .
B
A route for $0.0.0.0/0$ pointing to the virtual appliance at $172.16.0.4$ , and separate route table entries mapping individual IP addresses for all external Azure dependencies instead of utilizing the `AzureCloud` Service Tag in the route table.
A route for $0.0.0.0/0$ pointing to the virtual appliance at $172.16.0.4$ , and a route for $172.18.0.0/16$ pointing to the virtual appliance at $172.16.0.4$ .Cevap
D
A route for $0.0.0.0/0$ pointing to the virtual appliance at $172.16.0.4$ , and deploying an Azure Traffic Manager profile configured with path-based routing to terminate and forward HTTP traffic from the web tier to the database tier.

Cevap

Configure a route for

0.0.0.0/0

pointing to the virtual appliance at

172.16.0.4

, and a route for

172.18.0.0/16

pointing to the virtual appliance at

172.16.0.4

The correct configuration applies two specific User Defined Routes (UDRs) to the route table for the web subnet. The first route (

0.0.0.0/0

172.16.0.4

) handles all default egress to the internet. The second route (

172.18.0.0/16

172.16.0.4

) targets the peered database network. Because no user-defined route is configured for the local virtual network range (

172.17.0.0/16

), the default local system route remains active. This allows traffic between the web and business subnets to route directly without traversing the firewall, satisfying all requirements.

Adım Adım Çözüm

Identify the destinations that require transit through the Azure Firewall.

Internet traffic corresponds to prefix

0.0.0.0/0

. Traffic to the database virtual network corresponds to prefix

172.18.0.0/16

. Both require a next hop of the virtual appliance IP

172.16.0.4

This establishes the necessary forwarding rules to send the external traffic to the firewall.

Analyze how local subnet-to-subnet traffic within the application virtual network is routed.

By default, Azure creates a system route for the local virtual network prefix (

172.17.0.0/16

-> Local) which allows subnets like `snet-web` and `snet-biz` to communicate directly.

Understanding default system routes helps determine if any user-defined routes will interfere with them.

Evaluate user-defined routes to ensure they do not overlap with and override the local system route.

The configured routes (

0.0.0.0/0

and

172.18.0.0/16

) do not overlap with the local

172.17.0.0/16

address space. Therefore, local communication between `snet-web` and `snet-biz` remains direct and does not go to the firewall.

Ensures the design meets the requirement to keep local traffic direct and avoid firewall overhead.

Anahtar Kavram

Azure route selection behavior, User Defined Routes (UDR) override precedence, and Longest Prefix Match (LPM) logic for local virtual network traffic.

Tahmini Süre:1m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru