AZ-700 Question 56
Single answerYou have created a site-to-site VPN connection between your on-premises network and an Azure virtual network. One of your Azure VMs in a specific subnet cannot be reached from on-premises. This VM can communicate with other subnets in the Azure VNet, but not with any resources in the on-premises network. You suspect a user-defined route configuration issue in the subnet. Which of the following actions should you first take to diagnose and resolve this routing issue?
- A
Use Azure Network Watcher� Next Hop tool on the problematic VM to verify if the outbound next hop is pointed to the VPN gateway as intended.
- B
Add a custom default route (0.0.0.0/0) pointing to the VirtualNetworkGateway in the route table associated with all subnets in the VNet.
- C
Create a new route table that forwards all traffic to the on-premises public IP address and associate it with every subnet in the VNet.
- D
Modify the Network Security Group to allow inbound traffic on port 443 from your on-premises public IP address range.
Show answer and explanation
Correct answer: A
Explanation
Always begin diagnosing routing problems in Azure by inspecting the actual routes that a VM sees. Using the Next Hop tool in Azure Network Watcher reveals which path dependencies exist, confirming whether the user-defined routes correctly point traffic to the VirtualNetworkGateway or if there is a misconfiguration. Refer to Microsoft� documentation (https://learn.microsoft.com/azure/network-watcher/network-watcher-check-next-hop-portal) for detailed steps on using the Next Hop tool.
- A. Correct.
Correct. The Next Hop tool helps you verify the effective route for outbound traffic from the VM. This is the best first step in diagnosing whether the VM is correctly sending traffic to the VPN gateway or if there is a conflicting user-defined route.
- B. Incorrect.
Incorrect. Adding a default route pointing everything to the VPN gateway could cause unintended forced tunneling. This is not the safest first step and can break other traffic paths if misused.
- C. Incorrect.
Incorrect. Creating a route table that forwards all traffic to the on-prem IP address may override existing routes and could disrupt overall network connectivity. You need to diagnose the existing route configuration before adding new routes everywhere.
- D. Incorrect.
Incorrect. While an NSG might block traffic, the scenario indicates that the main issue is likely routing, given the VM can communicate with other subnets but not on-prem. Adjusting the NSG for port 443 alone does not address a likely routing misconfiguration.