AZ-800 - Microsoft Azure Networking Solutions Azure Virtual Network Peering Questions and Answers — Questions and Answers
Question 1: An Azure administrator has configured VNet peering between VNet-A and VNet-B, and also between VNet-B and VNet-C. A virtual machine in VNet-A needs to communicate with a virtual machine in VNet-C. Which statement accurately describes the connectivity between VNet-A and VNet-C?
- VNet-A and VNet-C can communicate by default because of the peering with VNet-B.
- VNet-A and VNet-C cannot communicate because VNet peering is non-transitive. (Correct answer)
- Communication is possible only if Global VNet Peering is used for both connections.
- A VPN Gateway must be deployed in VNet-B to allow traffic between VNet-A and VNet-C.
Correct answer: VNet-A and VNet-C cannot communicate because VNet peering is non-transitive.
Azure Virtual Network Peering is a non-transitive relationship. If VNet-A is peered with VNet-B, and VNet-B is peered with VNet-C, there is no implied or automatic peering relationship between VNet-A and VNet-C. To enable communication between VNet-A and VNet-C, they must be directly peered, or a Network Virtual Appliance (NVA) with user-defined routes must be configured in VNet-B to route the traffic.
Question 2: You are designing a hub-and-spoke network topology in Azure. The hub VNet (Hub-VNet) has a VPN gateway that provides connectivity to your on-premises network. You need to allow spoke VNets to access the on-premises network through the gateway in Hub-VNet. Which VNet peering configuration setting must be enabled?
- Allow forwarded traffic on the spoke VNet peering connections.
- Allow gateway transit on the Hub-VNet peering connection and Use remote gateways on the spoke VNet peering connections. (Correct answer)
- Enable 'Service Chaining' on all peering connections.
- Configure User-Defined Routes (UDR) on all spoke VNets pointing to the hub VNet.
Correct answer: Allow gateway transit on the Hub-VNet peering connection and Use remote gateways on the spoke VNet peering connections.
To allow spoke VNets to use the gateway in a hub VNet, you must enable 'Allow gateway transit' on the peering from the hub VNet to the spokes. Concurrently, on the peering from the spoke VNets to the hub, you must enable 'Use remote gateways'. This configuration allows the spoke VNets to use the hub's gateway for on-premises connectivity without needing their own gateways.
Question 3: Which of the following is a primary benefit of using Azure Virtual Network Peering to connect two VNets in the same region?
- Traffic between the peered VNets is automatically encrypted with IPsec.
- It extends the broadcast domain across the two virtual networks.
- It provides a low-latency, high-bandwidth connection using the Microsoft backbone. (Correct answer)
- It allows virtual networks with overlapping IP address spaces to be peered.
Correct answer: It provides a low-latency, high-bandwidth connection using the Microsoft backbone.
A key benefit of VNet peering is that it creates a direct, private connection between virtual networks using the Microsoft backbone infrastructure. This results in a low-latency, high-bandwidth connection for resources in the peered networks. Traffic is not automatically encrypted (though it is private), it does not extend the broadcast domain, and you cannot peer virtual networks with overlapping IP address spaces.
Question 4: A company has two Azure virtual networks, VNet-Sales in the East US region and VNet-Marketing in the West Europe region. They need to ensure resources in both VNets can communicate securely and privately. Which Azure networking feature should be used to connect these two VNets?
- A VNet-to-VNet VPN Gateway connection.
- Azure ExpressRoute.
- Local VNet Peering.
- Global VNet Peering. (Correct answer)
Correct answer: Global VNet Peering.
Global Virtual Network Peering is the feature designed to connect virtual networks across different Azure regions. This allows resources to communicate using private IP addresses over the Microsoft backbone network, just like with local peering, but between regions. Local VNet peering only works for VNets within the same region. While a VNet-to-VNet VPN or ExpressRoute could also connect them, Global VNet Peering is the most direct and often simplest solution for this scenario.
Question 5: An administrator wants to route all traffic from a spoke VNet through a Network Virtual Appliance (NVA) located in a peered hub VNet for inspection. What combination of features is required to implement this 'service chaining' scenario?
- Gateway Transit and a Route Table with a default route to the NVA.
- A Network Security Group (NSG) and VNet Peering.
- User-Defined Routes (UDR) and enabling 'Allow forwarded traffic' on the peering. (Correct answer)
- Global VNet Peering and Azure Firewall.
Correct answer: User-Defined Routes (UDR) and enabling 'Allow forwarded traffic' on the peering.
Service chaining enables you to direct traffic from one VNet to an NVA in a peered VNet. This is accomplished by creating a User-Defined Route (UDR) that specifies the IP address of the NVA as the next hop. Additionally, the 'Allow forwarded traffic' setting must be enabled on the VNet peering link from the hub to the spoke to permit the NVA to forward traffic that did not originate from itself.
Question 6: When configuring a VNet peering connection between VNet1 and VNet2, what is the status of the 'Peering status' property immediately after the administrator initiates the peering from VNet1 to VNet2, but before the reciprocal peering is created from VNet2 to VNet1?
- Connected
- Updating
- Initiated (Correct answer)
- Disconnected
Correct answer: Initiated
When a peering is created from one VNet to another, the peering status is 'Initiated'. It remains in this state until the corresponding, reciprocal peering link is created from the second VNet back to the first. Once both links are established, the status changes to 'Connected'.
AZ-800 - Microsoft Azure Networking Solutions Azure Virtual Network Peering Questions and Answers
An Azure administrator has configured VNet peering between VNet-A and VNet-B, and also between VNet-B and VNet-C.
A virtual machine in VNet-A needs to communicate with a virtual machine in VNet-C.
Which statement accurately describes the connectivity between VNet-A and VNet-C?