AZ-700 Question 43
Select 3You have a hub-and-spoke network design with three spoke virtual networks (VNets) that must send traffic through an NVA-based firewall deployed in a central hub VNet for inspection. The hub VNet has a Virtual Network Gateway configured to provide on-premises connectivity. You need to design a solution so that traffic from each spoke VNet is inspected by the NVA in the hub VNet before being routed to on-premises. Which steps must you implement to achieve service chaining with gateway transit?
- A
Enable 'Allow gateway transit' on the hub VNet peerings.
- B
Enable 'Use remote gateways' on each spoke VNet peering connected to the hub.
- C
Configure user-defined routes (UDRs) in each spoke VNet subnet to point traffic to the hub firewall as the next hop.
- D
Deploy a separate VPN or ExpressRoute gateway in each spoke VNet to ensure direct on-premises connectivity.
- E
Disable virtual network peering between the hub and spoke VNets to force firewall path selection.
Show answer and explanation
Correct answers: A, B, C
Explanation
To implement service chaining with gateway transit in a hub-and-spoke topology, you must enable gateway transit in the hub, configure the spokes to use the hub� gateway, and set up user-defined routes to direct traffic to the centralized firewall before it leaves for on-premises. Refer to Microsoft� documentation on hub-and-spoke network topology (https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) and virtual network peering (https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-peering#peeringsettings) for best practices and detailed configuration steps.
- A. Correct.
Correct. Allowing gateway transit on the hub VNet peering is essential so that traffic from the spokes can use the hub� gateway for on-premises connectivity.
- B. Correct.
Correct. Setting 'Use remote gateways' on the spoke VNet peerings ensures that the spokes leverage the hub� gateway instead of requiring their own, enabling gateway transit through the hub.
- C. Correct.
Correct. UDRs in the spoke subnets are necessary to send traffic intended for on-premises (or other spokes) to the central NVA/firewall IP in the hub VNet, implementing the service chaining path.
- D. Incorrect.
Incorrect. You do not need separate gateways in each spoke if you are leveraging gateway transit through the hub� gateway. Deploying multiple gateways is more complex and unnecessary in this scenario.
- E. Incorrect.
Incorrect. Disabling peering would break connectivity rather than force the firewall path. Service chaining relies on active hub-spoke peering with the correct route configuration.