AZ-700 Azure Routing 3

Question 1

You need all internet-bound traffic from Azure VMs to route through an on-premises firewall. Which configuration implements forced tunneling?

Accepted Answer

Configure a UDR with 0.0.0.0/0 pointing to the VPN or ExpressRoute gateway as next hop

Answer

Forced tunneling is implemented by creating a UDR for 0.0.0.0/0 with next hop VirtualNetworkGateway, which overrides the default internet route and sends all traffic through the VPN or ExpressRoute connection back to on-premises.

Question 2

In a hub-spoke topology where spoke VNets are peered to the hub, which configuration is required to route traffic between spoke VNets through an NVA in the hub?

Accepted Answer

Create UDRs in each spoke subnet with routes for other spokes' prefixes pointing to the NVA private IP

Answer

VNet peering is non-transitive, so UDRs must be created in each spoke's subnets directing inter-spoke traffic to the hub NVA's private IP address.

Question 3

What does a 'black hole' route mean in the context of Azure networking?

Accepted Answer

A route with next hop type 'None' that silently drops matching traffic

Answer

A black hole route uses the 'None' next hop type, causing Azure to silently discard all traffic matching that destination prefix without sending an ICMP unreachable message.

Question 4

Which Azure Virtual WAN component is responsible for managing route propagation and aggregation between connected branches, VNets, and hubs?

Accepted Answer

Virtual Hub Router

Answer

The Virtual Hub Router is the built-in routing engine within each Azure Virtual WAN hub that manages route tables, propagation, and association for all connected resources.

Question 5

When two VNets are connected via VNet peering with 'Allow Gateway Transit' enabled on the hub and 'Use Remote Gateways' on the spoke, what happens to the spoke VNet's routing?

Accepted Answer

The spoke VNet's subnets learn routes from the hub's connected gateways automatically

Answer

With 'Allow Gateway Transit' on the hub peering and 'Use Remote Gateways' on the spoke peering, the spoke subnets automatically receive routes from the hub's VPN or ExpressRoute gateway.

(AZ-700) Azure Network Engineer Associate Practice Test

(AZ-700) Azure Network Engineer Associate Practice Test

AZ-700 Azure Routing 3