AZ-700 Question 51
Single answerYou are working for a company that has deployed an Azure Virtual Network (VNet) using a hub-and-spoke topology. The hub subnet hosts a Network Virtual Appliance (NVA). You have created a custom route table that sends all outbound traffic (0.0.0.0/0) to the private IP address of the NVA as the next hop. You now want to ensure that all traffic from a spoke subnet named 'Spoke-1' goes through the NVA. What action must you take so that the custom route table becomes effective for 'Spoke-1'?
- A
Attach the custom route table to the NVA's network interface in the Azure portal
- B
Associate the custom route table with the 'Spoke-1' subnet through the route table's Subnet association settings
- C
Create a Network Security Group (NSG) for 'Spoke-1' and include the route table as part of the NSG
- D
Configure the custom route table as the default system route for the entire VNet
Show answer and explanation
Correct answer: B
Explanation
In Azure, custom route tables (UDRs) must be associated with specific subnets to override system routes. By associating your custom route table with the 'Spoke-1' subnet, you ensure that outbound traffic from that subnet goes through the NVA. For more details, refer to Microsoft Azure documentation on 'User-defined routes' and 'Associate a route table with a subnet': https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview.
- A. Incorrect.
Option 1: Incorrect. Attaching a route table directly to the NVA's NIC is not supported. In Azure, UDRs (User Defined Routes) are associated at the subnet level, not the NIC level.
- B. Correct.
Option 2: Correct. To ensure traffic in 'Spoke-1' follows the custom route, you must associate the route table with the 'Spoke-1' subnet in the route table's Subnet association settings. This will apply the user-defined routes to all resources within that subnet.
- C. Incorrect.
Option 3: Incorrect. A Network Security Group (NSG) governs network security rules (allow/deny), not routing. Associating the route table with an NSG does not apply routing rules to the subnet.
- D. Incorrect.
Option 4: Incorrect. You cannot configure a user-defined route table to override system routes globally for the entire VNet. You must associate UDRs at specific subnets to direct traffic as needed.