AZ-700 Question 202
Single answerYou are managing a three-tier application hosted in Azure, where the front-end tier (Subnet A) must route all incoming traffic through an Intrusion Detection System (IDS) deployed in Subnet B for inspection. You have created a new route table (with a user-defined route) specifying the IDS� private IP as the next hop. However, traffic from Subnet A continues to bypass the IDS and goes directly to its destination. Which action should you take to ensure that Subnet A� traffic is routed to the IDS?
- A
Enable BGP route propagation on the route table.
- B
Deploy the route table to the virtual network gateway subnet.
- C
Add a user-defined route with the Internet as the next hop type.
- D
Associate the route table with Subnet A.
Show answer and explanation
Correct answer: D
Explanation
When using user-defined routes (UDRs), you must associate the route table with the specific subnet whose traffic you want to control. In this scenario, associating the route table with Subnet A ensures that all traffic from that subnet is directed to the specified next hop�in this case, the IDS in Subnet B. According to Azure documentation, any custom route must be associated at the subnet level to override the default Azure system routes.
- A. Incorrect.
Incorrect. BGP route propagation primarily affects routes learned from on-premises or ExpressRoute connections. Enabling this will not ensure intra-VNet custom routes are applied.
- B. Incorrect.
Incorrect. Associating a route table with the virtual network gateway subnet applies routes to that specific subnet only, not to Subnet A where the traffic originates.
- C. Incorrect.
Incorrect. Setting the next hop type to 'Internet' would send traffic out to the public Internet, not to the IDS. This does not meet the requirement of forwarding traffic to a subnet-hosted IDS.
- D. Correct.
Correct. A custom route table must be explicitly associated with the subnet that will use the custom routes. Associating the route table with Subnet A ensures all traffic from Subnet A is redirected to the next hop you configured, which is the IDS in Subnet B.