AZ-700 Question 55
Single answerYou manage two subnets (SubnetA and SubnetB) within the same Azure virtual network (VNet). SubnetA is associated with a user-defined route table that has a custom default (0.0.0.0/0) route pointing to a network virtual appliance (NVA). After applying this route table, a VM in SubnetA can no longer reach a VM in SubnetB. A check of Effective Routes shows that the route for SubnetB (10.0.2.0/24) is missing, and traffic to that subnet is being forwarded to the NVA via the default route. You want to restore connectivity between these VMs while keeping the custom default route. What is the best way to resolve this issue?
- A
Remove the custom default route from the route table so that the system routes manage all traffic automatically.
- B
Add a specific route entry for SubnetB (10.0.2.0/24) in the route table, with the next hop set to Virtual Network.
- C
Enable IP forwarding on all VM network interfaces in SubnetA so that packets are forwarded appropriately.
- D
Create a Network Security Group (NSG) to permit inbound traffic from SubnetA to SubnetB on the default route.
Show answer and explanation
Correct answer: B
Explanation
When a custom default route to an NVA is added, Azure's system route to local subnets can be overridden. To fix this while keeping the default route, you must add a specific route entry for the subnet in question. Refer to Microsoft documentation on User-Defined Routes (UDRs) and the 'Effective Routes' troubleshooting steps. This ensures that traffic to other subnets within the same VNet is correctly routed using the Virtual Network next hop, rather than being redirected to the NVA.
- A. Incorrect.
Option 1 is incorrect. Removing the custom default route might restore intra-VNet routing but it also removes your intended default route through the NVA, which likely isn't desired. You want to keep the custom default route while also ensuring traffic to SubnetB is routed correctly.
- B. Correct.
Option 2 is correct. By adding a specific route to 10.0.2.0/24 that points to the Virtual Network, you ensure intra-VNet traffic doesn't go to the NVA. System routing handles local traffic unless overridden by a user-defined route, so explicitly defining the SubnetB route in your table resolves the issue.
- C. Incorrect.
Option 3 is incorrect. Enabling IP forwarding allows a VM to act as a router, but you typically only do this for NVA or firewall VMs. This won't fix the missing route issue in your route table and won't restore the direct path to SubnetB.
- D. Incorrect.
Option 4 is incorrect. NSGs control traffic at the security layer (allow or deny). The issue here is a missing route entry, not a blocked port. Creating or modifying NSGs won't fix a routing problem where traffic is being improperly forwarded to the NVA.