An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier … — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier application. The hub virtual network, `vnet-eus-hub` (address space: $10.100.0.0/16$ ), contains an Azure Firewall deployed at the internal IP address $10.100.1.4$ . A peered spoke virtual network, `vnet-eus-prod` (address space: $10.101.0.0/16$ ), contains two subnets: `snet-web` ( $10.101.10.0/24$ ) and `snet-db` ( $10.101.20.0/24$ ).

The security team requires that:
1. All outbound internet traffic from `snet-web` must be inspected by the Azure Firewall.
2. All traffic between `snet-web` and `snet-db` must be inspected by the Azure Firewall.
3. Virtual machines within `snet-web` must be able to communicate directly with each other without traversing the firewall.

A network engineer creates a route table named `rt-web-routes`, defines the following user-defined routes (UDRs), and associates the route table with `snet-web`:
- Route 1: Address prefix $0.0.0.0/0$ with a next hop of Virtual Appliance ( $10.100.1.4$ )
- Route 2: Address prefix $10.101.0.0/16$ with a next hop of Virtual Appliance ( $10.100.1.4$ )

During testing, the engineer observes that virtual machines within `snet-web` are unable to communicate with each other.

Which configuration change should the engineer implement in the route table to restore intra-subnet connectivity within `snet-web` while maintaining all security requirements?

A
Change the next hop of Route 2 to Virtual Network.
B
Delete Route 2 from the route table.
Replace Route 2 with a new route for address prefix $10.101.20.0/24$ and a next hop of Virtual Appliance ( $10.100.1.4$ ).Cevap
D
Add a new route with address prefix $10.101.10.0/24$ and a next hop of Virtual Appliance ( $10.100.1.4$ ).

Cevap

Replace the broad virtual network route with a specific route for the database subnet address prefix (

10.101.20.0/24

) pointing to the firewall as the next hop.

Replacing the broad

10.101.0.0/16

route with a specific route for the database subnet (

10.101.20.0/24

) targeting the firewall (

10.100.1.4

) correctly routes database traffic to the firewall. Because there is no longer a UDR overriding the local

10.101.10.0/24

range, traffic within the web subnet falls back to the system-defined local route (

10.101.0.0/16

-> Virtual Network). Since the system route is a longer prefix match than the default route (

0.0.0.0/0

), intra-subnet traffic bypasses the firewall and remains local.

Adım Adım Çözüm

Analyze the routing requirements and the current User-Defined Routes (UDRs) associated with the web subnet.

The current UDR (

10.101.0.0/16

with next hop

10.100.1.4

) is overriding the default system route for the entire virtual network, including the local subnet (

10.101.10.0/24

Because UDRs override system routes of the same prefix, all local traffic within the web subnet is being forwarded to the firewall, which breaks direct subnet communication.

Identify how to isolate the database subnet traffic from the local subnet traffic.

Define a more specific route targeting only the database subnet (

10.101.20.0/24

) with the next hop set to the firewall.

This satisfies the security requirement to inspect all database-bound traffic while removing the override on the local web subnet's IP range.

Verify how the remaining traffic types will be routed.

Intra-subnet web traffic (

10.101.10.0/24

) will match the system route (

10.101.0.0/16

-> Virtual Network) since it is more specific than the default route (

0.0.0.0/0

) and there is no overriding UDR. Outbound internet traffic will match the default route (

0.0.0.0/0

) and go to the firewall.

This meets all requirements: outbound traffic goes to the firewall, web-to-database traffic goes to the firewall, and intra-subnet web traffic remains local.

Anahtar Kavram

Azure User-Defined Routes (UDRs) override system-defined routes of the same prefix. Broader UDRs covering the entire VNet range will redirect intra-subnet traffic, which can break local communication. To prevent this, UDRs should target specific remote subnets rather than the entire VNet prefix, allowing local traffic to fall back to the system-defined local route.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru