AZ-700 Question 41
Select 2Your organization has deployed two Azure virtual networks (VNet1 and VNet2) in different regions. VNet1 includes an ExpressRoute connection to your on-premises environment. You need all on-premises traffic to reach VNet2 through VNet1� ExpressRoute gateway. Which two actions should you perform to ensure that VNet2 can use VNet1� gateway for inbound and outbound traffic between on-premises and VNet2?
- A
Enable the 'Use Remote Gateways' option in VNet2's peering configuration with VNet1.
- B
Enable the 'Gateway Transit' option in VNet2's peering configuration with VNet1.
- C
Configure a local network gateway in VNet2 referencing the on-premises address space.
- D
Enable 'Allow Gateway Transit' on VNet1's peering configuration with VNet2.
- E
Configure user-defined routes in VNet2 subnets pointing to VNet1's virtual network gateway.
Show answer and explanation
Correct answers: A, D
Explanation
To enable a spoke VNet (VNet2) to share the ExpressRoute gateway of a hub VNet (VNet1), configure VNet peering so that the hub VNet has 'Allow Gateway Transit' set, and the spoke VNet has 'Use Remote Gateways' set. These settings ensure that routing for on-premises address spaces propagates to VNet2 without requiring additional user-defined routes. Refer to Microsoft Azure documentation on Gateway Transit and VNet Peering (https://docs.microsoft.com/azure/virtual-network/virtual-network-manage-peering#gateway-transit) for more details.
- A. Correct.
Option 1: Correct. For VNet2 to use VNet1� existing ExpressRoute gateway, the VNet2 side of the peering must have the 'Use Remote Gateways' option enabled. This tells VNet2 to direct outbound traffic to the remote gateway found in VNet1, allowing traffic to flow to on-premises via ExpressRoute.
- B. Incorrect.
Option 2: Incorrect. The 'Gateway Transit' setting is typically enabled on the VNet that hosts the gateway (i.e., VNet1 in this scenario), not on VNet2. VNet2 needs to 'Use Remote Gateways' (option 1), while VNet1 has 'Allow Gateway Transit' enabled (option 4).
- C. Incorrect.
Option 3: Incorrect. A local network gateway is used to define on-premises address spaces for a site-to-site VPN configuration. Here, VNet1 already has ExpressRoute configured and VNet2 doesn�t need its own local network gateway to reach on-premises.
- D. Correct.
Option 4: Correct. In order for VNet2 to leverage the ExpressRoute gateway in VNet1, VNet1 must have 'Allow Gateway Transit' enabled in its peering configuration. This permits the gateway in VNet1 to be shared across peered VNets.
- E. Incorrect.
Option 5: Incorrect. In most ExpressRoute and peering configurations that use BGP, user-defined routes (UDRs) are not required if 'Allow Gateway Transit' and 'Use Remote Gateways' are configured correctly. BGP route propagation will automatically handle routes for on-premises traffic.