AZ-104 Question 208
Single answerYou have a virtual network with multiple subnets. You want to route traffic from the front-end subnet to a network virtual appliance (NVA) in your security subnet for inspection. You create a route table but notice traffic from the front-end subnet still does not reach the NVA. Which configuration step must you ensure is correct for the traffic to be properly routed to the NVA?
- A
Associate the route table with the NVA subnet to ensure it inspects connected traffic
- B
Use a User Defined Route with next hop type set to Virtual Network
- C
Assign the subnet to the route table specifying the NVA’s IP address as the next hop
- D
Deploy an Application Gateway in front of the NVA to enable route forwarding
Show answer and explanation
Correct answer: C
Explanation
When configuring user-defined routes to direct subnet traffic to an NVA, you must create a route in the route table associated with the source subnet and set the NVA's IP address as the next hop. This ensures any traffic leaving that subnet is redirected to the NVA for inspection.
- A. Incorrect.
Associating the route table with the NVA subnet alone does not route traffic from the front-end subnet to the NVA. The table must be associated with the subnet from which you want to redirect traffic.
- B. Incorrect.
Using next hop type Virtual Network only ensures traffic remains within the virtual network. It doesn’t redirect the traffic to the specific NVA IP address.
- C. Correct.
You must associate the route table with the front-end subnet and specify the NVA’s IP address as the next hop to ensure all traffic is directed to the NVA.
- D. Incorrect.
While Application Gateway can handle routing and load balancing of web traffic, it is not the direct means of forcing traffic from a subnet to an NVA for inspection. A user defined route is required to direct all traffic.