AZ-500 Question 55
Select 2You have a hub virtual network (VNet) in Azure that is connected to your on-premises environment via a VPN gateway. You create a new spoke VNet and want it to access on-premises resources through the hub VNet’s existing VPN gateway. Which two peering configurations between the hub VNet and the spoke VNet are required to enable the spoke to route traffic to on-premises?
- A
Enable ‘Allow gateway transit’ on the hub VNet’s peering to the spoke VNet
- B
Configure the spoke VNet peering to ‘Use remote gateways’
- C
Create a separate VPN gateway resource in the spoke VNet
- D
Disable ‘Allow forwarded traffic’ on both the hub and spoke peering configurations
Show answer and explanation
Correct answers: A, B
Explanation
To share a single VPN gateway across multiple VNets, you configure the hub VNet peering to ‘Allow gateway transit’ and the spoke VNet peering to ‘Use remote gateways.’ This setup is often implemented in a hub-and-spoke network design where the hub provides the on-premises connection for all spokes. For details, refer to Microsoft’s documentation on VNet peering and gateway transit: https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview.
- A. Correct.
Option 1: Correct. In a hub-and-spoke architecture where the hub VNet provides connectivity to on-premises with a VPN gateway, you must enable ‘Allow gateway transit’ on the peering from the hub to the spoke so the spoke can leverage the gateway in the hub.
- B. Correct.
Option 2: Correct. The spoke VNet peering must be configured to ‘Use remote gateways’ so that traffic from the spoke can be routed through the hub VNet’s VPN gateway to the on-premises environment. This is essential for the spoke to access on-premises resources without its own gateway.
- C. Incorrect.
Option 3: Incorrect. If the goal is to share the existing VPN gateway in the hub VNet, you do not need to create a separate VPN gateway in the spoke VNet. Doing so would be redundant and increase cost.
- D. Incorrect.
Option 4: Incorrect. Disabling ‘Allow forwarded traffic’ would block the necessary flow of traffic between the spoke, the hub, and on-premises. You need to keep it enabled to allow routing through the VPN gateway.