AZ-700 Question 201
Single answerYou have an Azure Virtual Network with two subnets: SubnetA (10.0.0.0/24) and SubnetB (10.0.1.0/24). SubnetB hosts a network virtual appliance (NVA) that inspects outbound traffic. You have created a route table with a user-defined route that sends all internet-bound traffic (0.0.0.0/0) from SubnetA to the NVA IP address as the next hop. However, traffic from SubnetA still flows directly to the internet instead of going through the NVA. Which additional configuration step should you perform to ensure SubnetA� traffic is routed through the NVA?
- A
Associate the route table with SubnetB and enable IP forwarding on the NVA.
- B
Associate the route table with SubnetA so the user-defined route applies to that subnet.
- C
Configure a load balancer rule that forwards all outbound traffic to the NVA.
- D
Add a public IP address on the NVA and update the next hop to 'Virtual Network Gateway'.
Show answer and explanation
Correct answer: B
Explanation
To force subnet-level traffic through a network virtual appliance, you must configure a user-defined route that specifies the NVA� IP address as the next hop AND associate that route table with the relevant subnet. For more information, refer to Microsoft� official documentation on user-defined routes: https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview.
- A. Incorrect.
Option 1: This is incorrect. Associating the route table with SubnetB does not affect traffic originating in SubnetA. The route table must be associated with the subnet whose traffic you want to control (SubnetA).
- B. Correct.
Option 2: This is correct. A user-defined route only takes effect when the route table is associated with the specific subnet in which you want to override the default routing. Associating it with SubnetA ensures its outbound traffic is directed to the NVA.
- C. Incorrect.
Option 3: This is incorrect. A load balancer rule alone will not alter the default routing path for SubnetA� outbound internet traffic. User-defined routes must be applied at the subnet level.
- D. Incorrect.
Option 4: This is incorrect. Changing the next hop to 'Virtual Network Gateway' would direct traffic toward an Azure VPN or ExpressRoute gateway. A public IP on the NVA is unrelated to the need for associating the route table with the correct subnet.