AZ-700 Question 44
Select 2You are designing a hub-and-spoke Azure networking architecture. The hub VNet contains an ExpressRoute Gateway for on-premises connectivity and a shared network virtual appliance (NVA) for security inspection. You have two spoke VNets: Spoke1 hosts critical application workloads, while Spoke2 hosts additional security services. You need to ensure traffic from Spoke1 routes through the NVA in Spoke2 for inspection and then uses the hub's gateway transit to reach on-premises resources. Which two actions should you take to achieve this service chaining design?
- A
Enable 'Allow gateway transit' on the hub-to-spoke peering and 'Use remote gateways' on the spoke-to-hub peering.
- B
Deploy a dedicated ExpressRoute Gateway in Spoke2 and configure BGP session there.
- C
Configure a user-defined route in Spoke1 that redirects traffic to the NVA IP address in Spoke2 for on-premises circuits.
- D
Set gateway transit only on the Spoke1-to-Spoke2 peering and rely on default routing for inspection.
Show answer and explanation
Correct answers: A, C
Explanation
In a hub-and-spoke Azure architecture, service chaining requires both custom routing and correct gateway peering configurations. By enabling 'Allow gateway transit' on the hub-to-spoke peering and selecting 'Use remote gateways' in each spoke, traffic can transit through the hub's ExpressRoute Gateway. Additionally, you need a user-defined route table in the spokes to forward traffic to the NVA for inspection. For more details, consult the Azure documentation on hub-and-spoke network topology and gateway transit best practices.
- A. Correct.
Correct. To allow spokes to use the hub's gateway, you must enable 'Allow gateway transit' from the hub side and 'Use remote gateways' from the spoke side. This configuration lets Spoke1 and Spoke2 route packets through the hub's ExpressRoute Gateway.
- B. Incorrect.
Incorrect. Deploying a separate ExpressRoute Gateway in Spoke2 is unnecessary for this scenario. Typically, only the hub VNet needs an ExpressRoute Gateway to allow service chaining through the NVA.
- C. Correct.
Correct. A user-defined route (UDR) in Spoke1 pointing on-premises-bound traffic to the NVA in Spoke2 is essential for forcing traffic through the inspection appliance before it travels to the hub.
- D. Incorrect.
Incorrect. You must enable gateway transit on the hub-spoke peerings. Simply setting gateway transit on a Spoke1-to-Spoke2 peering alone does not ensure traffic flows through the hub or uses the hub's ExpressRoute Gateway.