An enterprise is designing virtual network routing for a spoke virtual network named `vnet… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing virtual network routing for a spoke virtual network named `vnet-prod-spoke` (address space: $10.200.0.0/16$ ). The spoke VNet contains two subnets: `snet-app` ( $10.200.1.0/24$ ) and `snet-db` ( $10.200.2.0/24$ ). The spoke VNet is peered with a hub virtual network named `vnet-hub-weur` (address space: $10.100.0.0/16$ ), which hosts a Network Virtual Appliance (NVA) firewall at IP address $10.100.1.4$ .

You configure a route table named `rt-app` and associate it with the `snet-app` subnet to meet the following requirements:
- Requirement 1: All traffic to the on-premises network ( $172.16.0.0/12$ ) must be routed through the NVA firewall.
- Requirement 2: Traffic to other subnets within `vnet-prod-spoke` must route directly (not through the NVA) to minimize latency.
- Requirement 3: Traffic to the hub virtual network ( $10.100.0.0/16$ ) must be routed through the NVA firewall.

To implement this, you add the following user-defined routes to `rt-app`:
- `Route_Hub`: Prefix $10.100.0.0/16$ , Next hop: Virtual appliance ( $10.100.1.4$ )
- `Route_OnPrem`: Prefix $172.16.0.0/12$ , Next hop: Virtual appliance ( $10.100.1.4$ )
- `Route_Local`: Prefix $10.200.0.0/16$ , Next hop: Virtual appliance ( $10.100.1.4$ )

Which of the following statements correctly describe the impact of this configuration and the required action to satisfy the requirements? (Select TWO.)

Traffic destined for snet-db is incorrectly routed to the NVA firewall because Route_Local matches the local virtual network prefix exactly, and User Defined Routes take precedence over default system routes with the same prefix.Cevap
Deleting Route_Local from the route table resolves the local communication failure, allowing the default system route for the virtual network to direct traffic directly between the subnets.Cevap
C
Traffic destined for snet-db is routed directly because Azure system routes for local virtual network traffic always take precedence over user-defined routes regardless of prefix matching.
D
To resolve the local communication failure while keeping Route_Local, you must configure virtual network peering to use remote gateways.

Cevap

Traffic destined for the database subnet is sent to the NVA firewall because the user-defined route has the same prefix as the default local route and overrides it. To resolve the issue, the user-defined route matching the local VNet prefix must be deleted.

The user-defined route matching the local virtual network address space exactly (

10.200.0.0/16

) overrides the default local system route because UDRs have higher precedence than system routes for identical prefixes. Removing this route resolves the issue, as the default system route will then correctly direct local subnet-to-subnet traffic directly.

Adım Adım Çözüm

Identify the default system routes generated for the subnet.

A default local system route for

10.200.0.0/16

is created to route traffic within the virtual network directly.

To understand the baseline routing behavior before UDRs are applied.

Compare the user-defined Route_Local (

10.200.0.0/16

-> NVA) with the default local system route.

Both routes have the identical prefix

10.200.0.0/16

. In Azure, UDRs take precedence over system routes when prefixes match exactly.

To determine how Azure resolves conflicting routes of the same prefix length.

Determine the corrective action to meet the requirement of direct routing.

Deleting Route_Local allows the default local system route to handle local VNet traffic directly, while Route_Hub and Route_OnPrem continue to handle hub and on-premises traffic via the NVA.

To restore direct routing for local subnets without impacting other UDRs.

Anahtar Kavram

User-Defined Route precedence over default virtual network system routes of the same prefix length

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru