AZ-700 Question 89
Select 2Your company has an on-premises network originally configured with the 10.50.0.0/16 address space. You created a local network gateway in Azure named 'OnPremLNG' to establish a site-to-site VPN. Recently, your on-premises address space changed to 10.60.0.0/16, and users in Azure can no longer reach on-premises resources. You need to ensure traffic is correctly routed through the VPN to the new subnet range. Which two actions should you perform?
- A
- Update the local network gateway to include 10.60.0.0/16 as an additional address prefix.
- B
- Remove the 10.50.0.0/16 prefix from the local network gateway if it is no longer in use.
- C
- Change the BGP peer IP address on the local network gateway to 10.60.0.1.
- D
- Deploy an additional Azure VPN gateway using the new subnet range.
- E
- Configure route filtering in a Network Security Group to deny traffic from 10.50.0.0/16.
Show answer and explanation
Correct answers: A, B
Explanation
When the on-premises network range changes, you must update the local network gateway settings in Azure so that traffic is routed to the correct address space. The local network gateway stores the external IP of your on-premises VPN device and the address prefixes that define your on-premises network range. Removing unused or old prefixes avoids routing conflicts. Refer to official Microsoft documentation for site-to-site VPN configuration details and local network gateway best practices: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal.
- A. Correct.
Option 1: CORRECT. You must update the local network gateway settings with the new on-premises address space to ensure Azure knows where to route traffic for 10.60.0.0/16.
- B. Correct.
Option 2: CORRECT. Removing the old prefix (10.50.0.0/16) if it is no longer valid prevents potential routing conflicts and ensures traffic no longer attempts to flow to a revoked address space.
- C. Incorrect.
Option 3: INCORRECT. Changing the BGP peer IP address is only necessary if you are actually using BGP and your on-premises router's peer IP has changed. The scenario does not indicate a BGP configuration, and simply changing the peer IP to 10.60.0.1 is not the usual way to accommodate a new address range.
- D. Incorrect.
Option 4: INCORRECT. You do not need to deploy an additional Azure VPN gateway. Adjusting the existing local network gateway to cover the new address space is sufficient.
- E. Incorrect.
Option 5: INCORRECT. NSG route filtering does not fix the underlying issue of Azure not recognizing the new subnet. You must update the local network gateway address prefixes for proper routing.