AZ-500 Question 54
Single answerYou manage an Azure environment with a single virtual network that has two subnets: AppSubnet hosting your web servers and FirewallSubnet hosting a network virtual appliance (NVA)-based firewall. You create a user-defined route in a custom route table with a 0.0.0.0/0 prefix and Next Hop type ‘Virtual Appliance’ pointing to the firewall’s private IP address. However, you notice that traffic from AppSubnet is still going directly to the Internet instead of being routed through the firewall. Which configuration change must you implement to ensure that AppSubnet’s outbound traffic is forced through the firewall?
- A
Associate the custom route table with the FirewallSubnet.
- B
Configure the firewall’s public IP address in the next hop field of the route.
- C
Configure an additional default route with Next Hop type ‘Internet’ to override the existing route.
- D
Associate the custom route table with the AppSubnet.
Show answer and explanation
Correct answer: D
Explanation
To ensure user-defined routes take effect, you must associate the custom route table with the specific subnet from which you want to redirect traffic. In this scenario, that is AppSubnet. Refer to Microsoft’s official documentation on user-defined routes (https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview) for guidelines on how to properly configure and associate route tables.
- A. Incorrect.
Option 1 is incorrect because associating the route table with the FirewallSubnet only influences traffic in that subnet. To route traffic originating from AppSubnet, the route table must be associated with AppSubnet.
- B. Incorrect.
Option 2 is incorrect because user-defined routes in Azure typically require the firewall’s private IP address behind the Virtual Appliance next hop. Using the firewall’s public IP address for the next hop is not valid in the internal routing context.
- C. Incorrect.
Option 3 is incorrect because creating a new default route with Next Hop type ‘Internet’ would send traffic directly out to the Internet rather than forcing it through the firewall. It contradicts the goal of inspecting or filtering traffic with the firewall.
- D. Correct.
Option 4 is correct because to enforce a user-defined route, the custom route table must be associated with the subnet whose traffic you want to control. In this scenario, that subnet is AppSubnet.