AZ-700 Question 50
Select 2You have a virtual network (VNet) with two subnets: AppSubnet and NvaSubnet. The NvaSubnet contains a firewall appliance with an internal IP address of 10.0.2.4. You need to configure user-defined routes (UDRs) for AppSubnet so that all traffic to on-premises (10.10.0.0/16) and internet-bound traffic is routed through the firewall. However, traffic within the VNet itself (10.0.0.0/16) should remain local and not route through the firewall. Which UDR entries should you create in the route table associated with AppSubnet? (Choose two.)
- A
Add a route for 10.0.0.0/16 with next hop type Virtual Appliance at 10.0.2.4
- B
Add a route for 10.10.0.0/16 with next hop type Virtual Appliance at 10.0.2.4
- C
Add a route for 0.0.0.0/0 with next hop type Virtual Appliance at 10.0.2.4
- D
Add a route for 10.10.0.0/16 with next hop type Internet
Show answer and explanation
Correct answers: B, C
Explanation
User-defined routes let you override Azure's default system routes to control how traffic flows. In this scenario, to ensure both on-premises and internet-bound traffic pass through the firewall in NvaSubnet, you must define UDRs for 10.10.0.0/16 and 0.0.0.0/0 that specify the firewall as the next hop (Virtual Appliance). You do not modify routes for local VNet traffic (10.0.0.0/16) so that it remains local. For more details, refer to the official Azure documentation on 'User-defined routes' and best practices for managing custom routes.
- A. Incorrect.
Option 1: Incorrect. You should not redirect subnet-to-subnet traffic within the same VNet to the firewall, as it creates unnecessary hops. Traffic to local subnets typically uses system routes that keep it within the VNet.
- B. Correct.
Option 2: Correct. A user-defined route for 10.10.0.0/16 with next hop type Virtual Appliance directs on-premises-bound traffic from AppSubnet to the firewall in NvaSubnet.
- C. Correct.
Option 3: Correct. Routing 0.0.0.0/0 to the firewall enforces that all unknown (internet-bound) traffic from the AppSubnet passes through the firewall for inspection.
- D. Incorrect.
Option 4: Incorrect. This route would send on-premises traffic directly to the Internet instead of the firewall, violating the requirement to route on-premises traffic via the firewall.