AZ-700 Question 159
Single answerYour organization has an Azure Virtual WAN with a single virtual hub. There is a Site-to-Site (S2S) VPN connection from on-premises to the hub, and multiple spoke VNets also connect to this hub. You have deployed an Azure Firewall in one of the spoke VNets. By default, on-premises traffic destined for other spoke VNets is sent directly via the default route table. However, you need to ensure that all on-premises traffic to a specific spoke VNet must instead pass through the Azure Firewall. Which of the following steps will correctly configure the virtual hub routing for this requirement?
- A
A) Associate the default route table with the on-premises connection and add the Azure Firewall� private IP address as an additional static route to the default route table.
- B
B) Create a new custom route table in the virtual hub with a route pointing to the Azure Firewall� private IP, associate the on-premises connection with this new route table, enable route propagation from on-premises, and also associate the firewall VNet with the same custom route table so it can receive traffic correctly.
- C
C) Disable route propagation on both the default route table and the new custom route table, then rely on the automatic forwarding of packets by the Azure Firewall to the spoke VNet without referencing the firewall in the next hop.
- D
D) Add the Azure Firewall as a next hop on the default route table, but do not associate it with the on-premises connection or the spoke VNets, allowing the virtual hub to automatically direct traffic through the firewall.
Show answer and explanation
Correct answer: B
Explanation
In Azure Virtual WAN, you control traffic paths with custom route tables. When you want specific connections (such as an on-premises site) to send traffic via a security solution like Azure Firewall, you create a custom route table, define a route with the firewall� private IP as the next hop for the relevant address range, and associate the on-premises site connection and the firewall� VNet with this custom route table. Enabling route propagation for the on-premises connection ensures the custom route table learns about on-premises networks. Refer to the official Azure Virtual WAN documentation on �Configure routing intent and custom route tables� for details on the required association and propagation settings.
- A. Incorrect.
Option A is incorrect because simply adding the firewall� private IP to the default route table does not ensure that traffic to the spoke VNet will actually route through the firewall. You must create and associate a custom route table when specific routing is required.
- B. Correct.
Option B is correct. Creating a new custom route table, specifying the firewall� private IP as the next hop, associating the on-premises connection with the custom table, and ensuring the firewall's VNet is also associated to properly handle traffic flow through the firewall is the recommended approach. This setup forces on-premises traffic to go through the firewall before reaching the spoke VNet.
- C. Incorrect.
Option C is incorrect because simply disabling route propagation on both tables would prevent the necessary routing information from being distributed to or from the on-premises connection. Azure Firewall also needs an explicit next hop reference or an associated custom route table for proper routing.
- D. Incorrect.
Option D is incorrect. Although adding the firewall as a next hop on the default route table is a step, failing to associate this routing with the on-premises connection and the spoke VNet would not enforce traffic to pass through the firewall. Proper associations are necessary to direct traffic correctly.