AZ-500 Question 53
Single answerYou have deployed a network virtual appliance (NVA) in a dedicated subnet within the same virtual network (VNet) and want to ensure all outbound traffic from a specific subnet (Subnet A) is forwarded to the NVA for inspection. Which user-defined route (UDR) configuration should you implement to achieve this?
- A
Create a route table, add a route with the destination prefix 0.0.0.0/0 and next hop type 'Virtual Appliance' using the private IP of the NVA, then associate the route table with Subnet A.
- B
Create a route table, add a route with the destination prefix 0.0.0.0/0 and next hop type 'Internet', then associate the route table with Subnet A.
- C
Create a route table, add a route with the destination prefix 0.0.0.0/0 and next hop type 'Virtual Appliance' using the public IP of the NVA, then associate the route table with Subnet A.
- D
No user-defined route is required if the NVA resides in the same VNet, as Azure automatically forwards all egress traffic to the NVA.
Show answer and explanation
Correct answer: A
Explanation
User-defined routes are essential when you want to control the flow of traffic in Azure beyond the default system routes. In this scenario, to ensure outbound traffic from Subnet A is forwarded through the NVA for inspection, you create a custom route table with a default route pointing to the private IP of the NVA as the 'Virtual Appliance' next hop type. Microsoft documentation (e.g., 'Create a route table' in Azure documentation) outlines that the private IP must be used because Azure handles routing internally via private addresses for resources within the same VNet.
- A. Correct.
Option 1 is correct. When you have a network virtual appliance (NVA) in the same virtual network, you must create a route table for the subnet and define a default route (0.0.0.0/0) with next hop type 'Virtual Appliance.' The next hop IP address should be the private IP of the NVA interface in that subnet. You then attach (associate) this route table to Subnet A so that all outbound traffic is directed to the NVA for inspection.
- B. Incorrect.
Option 2 is incorrect. Specifying next hop type 'Internet' would send traffic directly to the internet rather than through the NVA, bypassing inspection. That route type is only used for routing traffic directly to the internet without any intermediate virtual appliance.
- C. Incorrect.
Option 3 is incorrect. You must use the NVA's private IP address, not its public IP. Azure routing within a VNet uses private IP addresses, and specifying the public IP would not properly forward traffic to the NVA inside the virtual network.
- D. Incorrect.
Option 4 is incorrect. By default, Azure routes traffic within a subnet to the destination directly if it resides in the same VNet, or out to the default gateway for external traffic. It does not automatically forward traffic to an NVA unless explicitly instructed through user-defined routes.