An enterprise is designing a hub-and-spoke virtual network topology in Azure with the foll… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure with the following resource allocations:

* Hub VNet (`vnet-hub-prod`): CIDR $10.200.0.0/16$ containing a Network Virtual Appliance (NVA) at IP address $10.200.1.10$ .
* Spoke VNet A (`vnet-spoke-web`): CIDR $10.201.0.0/16$ .
* Spoke VNet B (`vnet-spoke-data`): CIDR $10.202.0.0/16$ .

Virtual network peering is configured between `vnet-hub-prod` and `vnet-spoke-web`, and between `vnet-hub-prod` and `vnet-spoke-data`. No direct peering exists between the two spokes.

You are designing the routing tables for `vnet-spoke-web` to satisfy these requirements:
1. All outbound traffic destined for the database servers in `vnet-spoke-data` must transit through the NVA.
2. All outbound traffic destined for the management services in the hub VNet (`vnet-hub-prod`) must transit through the NVA.
3. Subnet-to-subnet traffic within `vnet-spoke-web` must remain direct and must not be sent to the NVA.

Which two routing configurations should you implement in the route table associated with the subnets in `vnet-spoke-web`?

A route for $10.200.0.0/16$ with the next hop set to Virtual Appliance and the IP address $10.200.1.10$ Cevap
A route for $10.202.0.0/16$ with the next hop set to Virtual Appliance and the IP address $10.200.1.10$ Cevap
C
A single route for $10.200.0.0/14$ with the next hop set to Virtual Appliance and the IP address $10.200.1.10$
D
A route for $10.201.0.0/16$ with the next hop set to Virtual Appliance and the IP address $10.200.1.10$
E
A route for $0.0.0.0/0$ with the next hop set to Virtual Network Gateway

Cevap

Configure two routes in the route table for the web spoke subnets: one route for the hub range of

10.200.0.0/16

pointing to the Network Virtual Appliance (NVA) at

10.200.1.10

, and another route for the database spoke range of

10.202.0.0/16

pointing to the same NVA IP address.

To route traffic from the web spoke to the hub VNet through the NVA, a route matching the exact prefix of the hub (

10.200.0.0/16

) must be defined. This overrides the system-defined VNet peering route. To route traffic to the database spoke, a route for

10.202.0.0/16

must also be defined pointing to the NVA, as there is no default system route for non-peered spokes. Leaving the local web spoke range (

10.201.0.0/16

) out of the custom route table ensures that local traffic utilizes the default system route and remains direct.

Adım Adım Çözüm

Analyze default system routes in the web spoke virtual network.

The web spoke contains a local system route for

10.201.0.0/16

(Virtual Network next hop) and a peering system route for

10.200.0.0/16

(VNet Peering next hop). No route exists for the database spoke (

10.202.0.0/16

Understanding the baseline system routes is critical to determining which traffic flows need to be explicitly overridden or added using User Defined Routes (UDRs).

Design the route to override the default hub peering path through the NVA.

Create a UDR for

10.200.0.0/16

pointing to the NVA IP address (

10.200.1.10

UDRs override system routes of the same prefix length. This successfully redirects hub-bound traffic through the NVA.

Design the route to reach the database spoke via the NVA.

Create a UDR for

10.202.0.0/16

pointing to the NVA IP address (

10.200.1.10

Because the spoke VNets are not directly peered, a route must be added to direct database-bound traffic to the NVA for transit routing.

Verify that local traffic remains unaffected.

No UDR is added for the

10.201.0.0/16

prefix, meaning the default local system route handles intra-VNet communication.

This satisfies the requirement that subnet-to-subnet traffic within the web spoke must remain direct and not transit the NVA.

Anahtar Kavram

Azure Longest Prefix Match (LPM) and Route Precedence

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru