Examkin

Soru

Zorluk: OrtaVirtual Network Connectivity and Routing

An enterprise is implementing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-prod-hub` (10.10.0.0/1610.10.0.0/16), hosts a firewall at 10.10.1.410.10.1.4. The spoke virtual network, `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16), contains two subnets named `subnet-web` (10.20.1.0/2410.20.1.0/24) and `subnet-app` (10.20.2.0/2410.20.2.0/24). To inspect traffic between the two spoke subnets, an administrator creates a route table and associates it with both subnets in `vnet-prod-spoke`. The route table contains a user-defined route (UDR) with the address prefix 10.20.0.0/1610.20.0.0/16 and a next hop of the firewall at 10.10.1.410.10.1.4. After this change, virtual machines within `subnet-web` can no longer communicate with each other, nor with virtual machines in `subnet-app`. Which of the following describes the cause of this connectivity failure?

  1. A
    The subnets require individual security rules for each virtual machine interface IP address instead of using Service Tags within the associated Network Security Groups.
  2. The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.Cevap
  3. C
    The virtual machines are connected to a Basic Load Balancer, which prevents the route table from applying next hop rules to the subnets.
  4. D
    The user-defined route conflicts with system routes because it does not define a separate, non-overlapping subnet route to prioritize local VNet routing.

Cevap

The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.
The correct answer is correct because Azure route selection prioritizes user-defined routes (UDRs) over default system routes when the prefixes are identical. By configuring a UDR with the prefix 10.20.0.0/1610.20.0.0/16 (which matches the spoke VNet address space) and setting the next hop to the firewall, all traffic within the VNet (including intra-subnet traffic) is forwarded to the firewall. Since the firewall is not designed to receive, process, and return traffic destined for the same local subnet without complex configurations, internal communication breaks.

Adım Adım Çözüm

1
Analyze the user-defined route prefix configured in the route table.
The route table has a route for 10.20.0.0/1610.20.0.0/16 pointing to the firewall at 10.10.1.410.10.1.4.
To identify the destination and next hop of the user-defined route.
2
Compare the route prefix with the local virtual network address space.
The prefix matches the address space of `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16) exactly.
To determine how the route interacts with the default local system route.
3
Apply Azure routing precedence rules.
UDRs take precedence over default system routes. The route to 10.20.0.0/1610.20.0.0/16 via the firewall overrides the default 'Vnet' route.
To identify why intra-subnet and inter-subnet traffic within the spoke is diverted to the firewall, causing communication to break.

Anahtar Kavram

User-defined route overrides for local virtual network traffic
Bu soruyu puanla

Konular

Virtual Network Connectivity and Routing

Bu konudan daha fazla soru