AZ-700 Question 160
Single answerYou manage an Azure Virtual WAN environment for a multinational company with a single virtual hub in the East US region. The hub is connected to your on-premises data center via Site-to-Site VPN, and it also connects to a virtual network (VNet) hosting a third-party network virtual appliance (NVA). You need to ensure that all traffic from the on-premises data center flows through the third-party NVA in the VNet before reaching other Azure VNets or services. Which action should you take to correctly configure virtual hub routing for this requirement?
- A
Create a custom route table in the virtual hub using a 0.0.0.0/0 route with next hop set to the NVA IP. Associate the Site-to-Site VPN connection with this custom route table and disable route propagation from the default table.
- B
Enable forced tunneling in the default route table and set the NVA as a next hop for all connections by propagating routes from the VNet hosting the NVA.
- C
Configure BGP route advertising on the NVA to announce a default route back to the virtual hub. Point the Site-to-Site VPN connection to this default route.
- D
Associate both the VPN connection and the NVA VNet to the default hub route table, leaving route propagation enabled on all connections.
Show answer and explanation
Correct answer: A
Explanation
In Azure Virtual WAN, to route on-premises traffic through an NVA, you typically create a custom route table in the virtual hub. Add a default 0.0.0.0/0 route pointing to the NVA as next hop, then associate the Site-to-Site VPN connection with this custom route table. Disabling route propagation from the default table prevents conflicts with other learned routes. This approach is documented in Microsoft� guidance for configuring routing in Azure Virtual WAN.
- A. Correct.
Correct. Creating a custom route table and assigning a default route (0.0.0.0/0) pointing to the NVA� IP address ensures all traffic from the on-premises VPN is forwarded to the third-party NVA. Disabling propagation from the default table prevents unintended routes from overriding this custom route. Associating the Site-to-Site VPN connection with this route table enforces the new routing path.
- B. Incorrect.
Incorrect. Simply enabling forced tunneling in the default route table and propagating routes from the VNet hosting the NVA does not guarantee that on-premises traffic will be diverted through that NVA. You must explicitly create a custom route table with the correct next hop and associate it with the on-premises connection.
- C. Incorrect.
Incorrect. Configuring BGP route advertisements from the NVA can help share routes but does not ensure that all Site-to-Site VPN traffic is forced through the NVA. You still need a custom route table to define the default route and associate it with the VPN connection.
- D. Incorrect.
Incorrect. Associating both connections with the default hub route table without custom routes and propagation rules won�t enforce using the NVA. The default table alone cannot redirect all on-premises traffic to the NVA unless a deliberate route entry is in place.