Exam AZ-104 topic 5 question 149 discussion

Actual exam question from Microsoft's AZ-104

Question #: 149
Topic #: 5

You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2. VNet1 has a VPN gateway that uses static routing,

The on-premises network has a VPN connection that uses the VPN gateway of VNet1.

You need to configure access for users on the on-premises network to connect to a virtual machine on VNet2. The solution must minimize costs.

Which type of connectivity should you use?

A. Azure Firewall with a private IP address
B. service chaining and user-defined routes (UDRs)
C. Azure Application Gateway
D. ExpressRoute circuits to VNet2

Show Suggested Answer

Suggested Answer: B 🗳️

by dendenp at Aug. 24, 2024, 5:39 a.m.

Comments

Submit Cancel

dendenp

Highly Voted 10 months, 1 week ago

Selected Answer: B

To configure access for users on the on-premises network to connect to a virtual machine on VNet2 while minimizing costs, you should use B. service chaining and user-defined routes (UDRs). Here’s how you can achieve this: User-Defined Routes (UDRs): Create a UDR in VNet1 that directs traffic destined for VNet2 to the VPN gateway. This ensures that traffic from the on-premises network to VNet2 flows through the VPN gateway of VNet1. Service Chaining: Enable service chaining on the VPN gateway in VNet1. Service chaining allows the VPN gateway to forward traffic to other services (such as Azure Firewall or Azure Application Gateway) before reaching its final destination. In this case, configure the VPN gateway to forward traffic to VNet2 through the UDR. By combining UDRs and service chaining, you can achieve connectivity between the on-premises network and the virtual machine on VNet2 while minimizing costs.

upvoted 13 times

...

8ac3742

Most Recent 2 months, 2 weeks ago

Selected Answer: B

Here Service Chaining refers to "enable Gateway transit" in vNet1 peering and "allow remote Gateway" in vNet2 peering. The UDR route table is installed in vNet2 which direct the response to the request from on-premise network to the Gateway then reach on-premise network.

upvoted 1 times

8ac3742

2 months, 2 weeks ago

my last explanation is incorrect, here is the correct explanation Service Chaining involves enabling Gateway transit in vNet1 and allowing remote Gateway in vNet2. When a request from on-premises reaches the Gateway, it will be directed to vNet2 via the Gateway. The response to the on-premises request will be routed through the Gateway using the UDR (User Defined Route) in the Route Table configured in vNet2.

upvoted 1 times

...

8ac3742

2 months, 2 weeks ago

Selected Answer: B

B traffic sourced from on-premise network -> VPN Gateway configured in vNet1 -> UDR which is hosted in the Route Table which is associated with the subnet of VPN Gateway -> VPN Gateway configured in vNet1 ->(via service chaining configured in VPN Gateway) -> vNet2

upvoted 2 times