AZ-700 Azure Routing 3

Question 1

You need all internet-bound traffic from Azure VMs to route through an on-premises firewall. Which configuration implements forced tunneling?

Accepted Answer

Configure a UDR with 0.0.0.0/0 pointing to the VPN or ExpressRoute gateway as next hop

Answer

Create an NSG rule blocking all outbound internet traffic on all ports

Answer

Enable Azure DDoS Protection Standard on the VNet

Answer

Deploy Azure Firewall and create a DNAT rule for outbound traffic

Question 2

In a hub-spoke topology where spoke VNets are peered to the hub, which configuration is required to route traffic between spoke VNets through an NVA in the hub?

Accepted Answer

Create UDRs in each spoke subnet with routes for other spokes' prefixes pointing to the NVA private IP

Answer

Enable gateway transit on the hub-spoke peering connections only

Answer

Configure BGP on the spoke VNets to learn routes from the hub

Answer

Enable VNet peering transitivity in the Azure portal settings

Question 3

What does a 'black hole' route mean in the context of Azure networking?

Accepted Answer

A route with next hop type 'None' that silently drops matching traffic

Answer

A route that sends traffic to the nearest Microsoft backbone node

Answer

A route used for diagnostic packet capture purposes

Answer

A route that loops traffic back to the originating VM

Question 4

Which Azure Virtual WAN component is responsible for managing route propagation and aggregation between connected branches, VNets, and hubs?

Accepted Answer

Virtual Hub Router

Answer

Azure Route Server

Answer

ExpressRoute Gateway

Answer

Azure Firewall Manager

Question 5

When two VNets are connected via VNet peering with 'Allow Gateway Transit' enabled on the hub and 'Use Remote Gateways' on the spoke, what happens to the spoke VNet's routing?

Accepted Answer

The spoke VNet's subnets learn routes from the hub's connected gateways automatically

Answer

The spoke VNet loses all internet connectivity

Answer

UDRs in the spoke are required to enable gateway transit

Answer

The spoke VNet creates its own VPN gateway to connect on-premises

Question 6

Which tool in the Azure portal allows you to trace the next hop for traffic from a specific VM to a destination IP address for routing troubleshooting?

Accepted Answer

Network Watcher – Next Hop

Answer

Azure Advisor

Answer

Traffic Analytics

Answer

Azure Monitor – Network Insights

Question 7

You have a route table with a UDR for 10.1.0.0/16 pointing to an NVA. The NVA also resides in the same subnet. What routing issue can occur?

Accepted Answer

The NVA will drop all traffic due to IP forwarding being disabled by default

Answer

Traffic may loop back to the NVA if the NVA's subnet also has a UDR for the destination

Answer

The UDR is invalid because NVA IPs cannot be next hops within the same subnet

Answer

The route table will be automatically removed from the subnet