AZ-800 Azure Virtual Network Peering 2 — Questions and Answers
Question 1: A VNet peering connection shows 'Initiated' status on one side but 'Connected' on the other. What does this indicate?
- The peering is fully functional in both directions
- The peering configuration is incomplete and needs a reciprocal link created on the other VNet (Correct answer)
- A temporary sync delay that resolves automatically within 5 minutes
- The VNets are in different regions and require global peering approval
Correct answer: The peering configuration is incomplete and needs a reciprocal link created on the other VNet
'Initiated' means only one side of the peering has been created; the administrator of the peer VNet must create the reciprocal peering link to reach 'Connected' state.
Question 2: Which property must be enabled on a VNet peering to allow traffic from the peered VNet to traverse an Azure VPN Gateway hosted in the local VNet?
- Allow forwarded traffic
- Allow gateway transit (Correct answer)
- Use remote gateways
- Allow virtual network access
Correct answer: Allow gateway transit
'Allow gateway transit' must be enabled on the hub VNet's peering so that the spoke VNet can use the hub's VPN Gateway for on-premises connectivity.
Question 3: An organization has VNet-A peered with VNet-B, and VNet-B peered with VNet-C. A VM in VNet-A cannot reach a VM in VNet-C. What is the most likely cause?
- NSG rules are blocking cross-VNet traffic by default
- VNet peering is non-transitive, so VNet-A and VNet-C have no direct route (Correct answer)
- Global peering does not support multi-hop routing
- The subscription limit for peering connections has been reached
Correct answer: VNet peering is non-transitive, so VNet-A and VNet-C have no direct route
Azure VNet peering is non-transitive, meaning traffic cannot flow through an intermediate VNet; VNet-A must be directly peered with VNet-C to communicate.
Question 4: What is the maximum number of VNet peering connections supported per VNet by default?
- 100
- 500 (Correct answer)
- 1000
- 250
Correct answer: 500
Azure supports up to 500 VNet peering connections per VNet by default, though this limit can be increased via a support request.
Question 5: A company needs VMs in a peered spoke VNet to resolve DNS using a custom DNS server hosted in the hub VNet. Which peering setting must be enabled on the spoke VNet's peering link?
- Allow gateway transit
- Use remote gateways
- Allow forwarded traffic (Correct answer)
- Allow virtual network access
Correct answer: Allow forwarded traffic
'Allow forwarded traffic' on the spoke's peering link permits traffic originating outside the hub VNet (such as DNS queries forwarded by the hub's DNS server) to traverse the peering.
Question 6: When peering VNets across different Azure Active Directory (AAD) tenants, what is required to authorize the peering?
- Both VNets must be in the same subscription
- The remote VNet's resource ID must be provided and the remote tenant admin must create the reciprocal peering (Correct answer)
- An Azure AD B2B invitation must be accepted before peering can be initiated
- Cross-tenant peering requires an ExpressRoute circuit between tenants
Correct answer: The remote VNet's resource ID must be provided and the remote tenant admin must create the reciprocal peering
Cross-tenant VNet peering requires the initiating admin to supply the remote VNet's resource ID; the admin of the remote tenant then creates the reciprocal peering link to complete the connection.
Question 7: Which statement correctly describes the traffic flow and latency characteristics of VNet peering?
- Traffic traverses the public internet with TLS encryption
- Traffic flows over the Azure backbone network with low latency and no public internet exposure (Correct answer)
- Traffic is routed through an Azure Load Balancer in the peered region
- Traffic uses an IPsec VPN tunnel between the two VNets
Correct answer: Traffic flows over the Azure backbone network with low latency and no public internet exposure
VNet peering routes traffic over Microsoft's private backbone network, providing low latency and high bandwidth without exposing data to the public internet.
AZ-800 Azure Virtual Network Peering 2
A VNet peering connection shows 'Initiated' status on one side but 'Connected' on the other.
What does this indicate?