AZ-500 Question 52
Single answerYou manage an Azure environment with a virtual network that includes two subnets: SubnetA (10.0.1.0/24) hosting application servers, and SubnetB (10.0.2.0/24) hosting a third-party network virtual appliance (NVA) for advanced traffic inspection. You want all outbound internet traffic from SubnetA to flow through the NVA in SubnetB for security scanning. Which configuration should you implement using user-defined routes (UDRs)?
- A
Associate a route table with SubnetB specifying the route for 10.0.1.0/24, next hop type Virtual Appliance, next hop address set to the default gateway of SubnetA.
- B
Create and associate a route table with SubnetA that includes a route for 0.0.0.0/0, next hop type Virtual Appliance, and next hop address set to the private IP of the NVA in SubnetB.
- C
Enable forced tunneling in Network Security Groups on SubnetA so that traffic automatically redirects to the default internet gateway.
- D
Assign a public IP to the NVA and enable IP forwarding on the NVA, ensuring outbound traffic from SubnetA passes directly to the internet.
Show answer and explanation
Correct answer: B
Explanation
To force outbound internet traffic from SubnetA through a network virtual appliance in SubnetB, you must create a user-defined route that directs 0.0.0.0/0 to the NVA's private IP address with the next hop type set to 'Virtual Appliance.' Then, associate that custom route table with SubnetA. This ensures that any outbound traffic from SubnetA is inspected by the NVA before leaving the virtual network. For more information, refer to Microsoft's documentation on user-defined routes at https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview.
- A. Incorrect.
Option 1 is incorrect because the route table is associated with SubnetB rather than SubnetA. Moreover, specifying a route for 10.0.1.0/24 with next hop as the default gateway does not direct outbound internet traffic through the NVA.
- B. Correct.
Option 2 is correct. By associating a route table with SubnetA and creating a 0.0.0.0/0 route that uses the NVA's private IP as the next hop (type Virtual Appliance), all outbound internet traffic from SubnetA is forced to flow through the NVA in SubnetB for inspection.
- C. Incorrect.
Option 3 is incorrect because forced tunneling is not achieved through Network Security Groups (NSGs). NSGs control access (inbound/outbound rules) but do not define routing paths. Proper forced tunneling typically involves configuring a user-defined route or using a VPN gateway with BGP route propagation.
- D. Incorrect.
Option 4 is incorrect. Assigning a public IP to the NVA and enabling IP forwarding helps manage inbound traffic or allows the NVA to pass traffic if traffic is routed to it, but it does not automatically route all SubnetA outbound traffic to the NVA. A user-defined route on SubnetA is required.