AZ-104 Question 204
Select 2You manage an Azure environment that includes two virtual networks (VNetA and VNetB) in different subscriptions. Both VNets have unique, non-overlapping address spaces. You want to enable direct communication between these networks over the Azure backbone with minimal latency. Which two actions should you take to establish connectivity between VNetA and VNetB?
- A
Create a virtual network peering from VNetA to VNetB
- B
Create a virtual private gateway to route traffic between the VNets
- C
Enable traffic forwarding on a Network Security Group (NSG) tied to each VNet
- D
Create a virtual network peering from VNetB to VNetA
Show answer and explanation
Correct answers: A, D
Explanation
When configuring virtual network peering, each VNet must have a peering to the other, ensuring that traffic can flow bidirectionally using the Azure backbone. Because the VNets already have non-overlapping address ranges, the only additional required steps are to create the peerings from each side.
- A. Correct.
A separate virtual network peering must be created in each direction (from VNetA to VNetB) for bidirectional communication. This is one of the required steps.
- B. Incorrect.
A virtual private gateway (or VPN gateway) is not required for direct peering within Azure. This is used for site-to-site VPN or connection to on-premises networks, not VNet peering between Azure VNets.
- C. Incorrect.
You do not need to enable 'traffic forwarding' on an NSG for this scenario. NSGs control traffic at a subnet or network interface level but do not establish the virtual network peering itself.
- D. Correct.
A matching peering must also be created from VNetB to VNetA, ensuring both VNets trust and can route traffic to each other over the Azure backbone.