AZ-700 Question 162
Single answerYou have deployed a third-party firewall as a network virtual appliance (NVA) in a spoke virtual network. You also use an Azure Virtual WAN hub to manage connectivity between on-premises sites and your Azure resources. You want to ensure that all on-premises traffic to your Azure workloads passes through this NVA for inspection. Which of the following configurations is required to properly route on-premises traffic to the third-party NVA via the Virtual WAN hub?
- A
Configure forced tunneling in the Virtual WAN hub so all traffic from the on-premises site is routed back to on-premises gateways.
- B
Create a custom route table in the Virtual WAN hub, specifying the NVA� private IP address as the next hop for on-premises IP address ranges.
- C
Deploy the third-party NVA directly in the Virtual WAN hub, bypassing any need for additional route tables or user-defined routes.
- D
Rely on the default Virtual WAN hub route propagation to automatically direct on-premises traffic through the NVA in the spoke virtual network.
Show answer and explanation
Correct answer: B
Explanation
To integrate a third-party NVA with Azure Virtual WAN for traffic inspection, you must configure custom routing within the Virtual WAN hub and associate on-premises connections with that routing policy. This involves creating a custom route table to direct specific address ranges (such as on-premises subnets) to the NVA� private IP. For additional details, refer to Microsoft� documentation on Virtual WAN routing: https://learn.microsoft.com/azure/virtual-wan/howto-routing.
- A. Incorrect.
Incorrect. Forced tunneling in Virtual WAN hub directs traffic to on-premises gateways, not the NVA in the spoke. This does not achieve the objective of sending on-premises traffic to the NVA for inspection within Azure.
- B. Correct.
Correct. You need to create a custom route table in the Virtual WAN hub and specify a route that points on-premises address ranges to the NVA� private IP as the next hop. This ensures on-premises traffic flows through the NVA firewall before reaching other Azure resources.
- C. Incorrect.
Incorrect. Third-party NVAs cannot be deployed inside the Virtual WAN hub itself. They must be hosted in a separate virtual network (spoke) or connected environment. You still need custom routing in the Virtual WAN hub to forward traffic to that NVA.
- D. Incorrect.
Incorrect. Default Virtual WAN routing propagates learned routes but does not automatically insert a route to an NVA in a spoke. You must explicitly configure a custom route to send traffic to the NVA.