AZ-104 Question 203
Single answerYou manage an Azure environment with two separate virtual networks: VNet1 (which has a VPN gateway) and VNet2. You need to configure VNet peering so that resources in VNet2 can use the VPN gateway in VNet1 for on-premises connectivity. Which configuration should you implement on the peerings?
- A
Enable 'Allow gateway transit' on the VNet1 peering and 'Use remote gateways' on the VNet2 peering to share VNet1’s gateway.
- B
Enable 'Use remote gateways' on both VNet peerings to allow each VNet to use its own local gateway.
- C
Enable 'Allow forwarded traffic' on both VNet peerings to allow traffic to be forwarded between VNet1 and VNet2.
- D
Disable 'Allow gateway transit' on both VNet peerings to ensure local traffic does not leave its VNet.
Show answer and explanation
Correct answer: A
Explanation
When peering two VNets so that one can use the other's VPN gateway, the gateway-hosting VNet must have 'Allow gateway transit' enabled. The other VNet must have 'Use remote gateways' configured, enabling it to route traffic through the remote gateway.
- A. Correct.
This is the correct configuration. The VNet hosting the gateway must have 'Allow gateway transit' enabled, and the peered VNet must be set to 'Use remote gateways' to leverage the gateway in the other VNet.
- B. Incorrect.
Enabling 'Use remote gateways' on both sides without 'Allow gateway transit' on the gateway-hosting VNet will not allow shared access to the VPN gateway.
- C. Incorrect.
Allowing forwarded traffic is used for scenarios like NVA forwarding but does not alone enable the use of a gateway from another VNet.
- D. Incorrect.
Disabling 'Allow gateway transit' prevents the use of a gateway in a peered VNet, so on-premises connectivity through the remote gateway will not be possible.