AZ-700 Question 42
Select 3Your organization has deployed a hub-and-spoke architecture in Azure. The Hub VNet contains an Azure VPN Gateway connected to the on-premises network via a site-to-site VPN. The Spoke VNet is peered to the Hub VNet, and you want to route all traffic (including Internet-bound traffic) from the Spoke VNet through the on-premises network for inspection. However, traffic from the Spoke is currently going directly to the Internet instead of routing through on-premises. Which of the following changes should you implement to ensure the Spoke VNet traffic is routed through the on-premises network?
- A
Enable the 'Allow gateway transit' setting on the Hub VNet side of the peering.
- B
Enable the 'Use remote gateways' setting on the Spoke VNet side of the peering.
- C
Advertise a default route (0.0.0.0/0) from the on-premises VPN device into Azure via BGP.
- D
Create a user-defined route (UDR) in the Spoke subnets using a next hop type of Virtual Appliance pointing to the Hub VNet's gateway IP.
- E
Disable 'Allow forwarded traffic' on both sides of the Hub and Spoke VNet peerings.
Show answer and explanation
Correct answers: A, B, C
Explanation
To force Spoke VNet traffic through the on-premises network, you must enable gateway transit on the Hub VNet, configure the Spoke to use remote gateways, and ensure a default route is advertised to Azure (commonly via BGP) so that Azure recognizes the on-prem network as the next hop for 0.0.0.0/0. These settings align with Microsoft best practices for a hub-and-spoke model with forced tunneling. Refer to Microsoft Azure documentation on VNet peering (https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview) and forced tunneling (https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-forced-tunneling-azure-traffic) for detailed guidance.
- A. Correct.
Correct. For forced tunneling through the on-premises network, the Hub VNet must allow gateway transit so that the Spoke can route traffic via the Hub� VPN Gateway.
- B. Correct.
Correct. The Spoke VNet must use the remote gateway in the Hub VNet for traffic destined to on-premises or the Internet, which is a key setting for forced tunneling.
- C. Correct.
Correct. A default route advertised from on-premises via BGP ensures that Azure subnets (including the Spoke VNet) can learn the 0.0.0.0/0 path back to on-premises.
- D. Incorrect.
Incorrect. Setting a UDR with a next hop type of Virtual Appliance pointing to the Hub gateway IP is not a valid configuration for routing to an Azure VPN Gateway. The correct next hop type for a UDR to route traffic to an Azure VPN Gateway is 'Virtual network gateway,' not 'Virtual appliance.'
- E. Incorrect.
Incorrect. Disabling 'Allow forwarded traffic' would prevent the Spoke from sending traffic through the Hub, which is the opposite of the requirement to route all Spoke traffic on-premises.