AZ-104 Question 199
Single answerYou are configuring a new Azure Virtual Network named VNet1 with three subnets: front-end, middle-tier, and back-end. You must ensure that any traffic from the middle-tier subnet to the back-end subnet is routed through a Network Virtual Appliance (NVA) deployed in the middle-tier subnet. Which configuration should you implement to achieve this requirement?
- A
Add a user-defined route in the middle-tier subnet’s route table, specifying the NVA’s IP address as the next hop for traffic destined for the back-end subnet
- B
Enable a service endpoint for the middle-tier subnet
- C
Configure a custom DNS server pointing to the NVA
- D
Assign a Network Security Group to the back-end subnet that allows only inbound traffic from the NVA’s IP address
Show answer and explanation
Correct answer: A
Explanation
To ensure that traffic from the middle-tier subnet to the back-end subnet is routed through the NVA, you must create a custom route in a route table associated with the middle-tier subnet. This user-defined route specifies the NVA as the next hop, forcing traffic destined for the back-end subnet to pass through the NVA.
- A. Correct.
This creates a custom route directing all traffic from the middle-tier subnet to the NVA before reaching the back-end subnet, fulfilling the requirement
- B. Incorrect.
Service endpoints allow secure direct connectivity to Azure services, but they do not control traffic flow between subnets or force routing through an NVA
- C. Incorrect.
Using a custom DNS server in itself does not redirect traffic flows; it only resolves hostnames to IP addresses
- D. Incorrect.
While a Network Security Group can limit access, it does not enforce routing through the NVA. It only restricts or allows traffic