Exam AZ-103 topic 4 question 21 discussion

VM2 cannot ping VM3 since peering is a two-way connection.

Yes,No,No

- Yes - No - No

VM1 -> VM3 = Yes; peering in both VMs enabled vnet1 <--> vnet3 vnet3 ---> vnet1 VM2 -> VM3 = No; because VM3 can't reply back to VM2 vnet2 ---> vnet3 (only one way ) VM2 -> VM1 = No; No peering between 1&2 No peering between 1&2

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#my-vnet-peering-connection-is-in-initiated-state-why-cant-i-connect If your peering connection is in an Initiated state, this means you have created only one link. A bidirectional link must be created in order to establish a successful connection. For example, to peer VNet A to VNet B, a link must be created from VNetA to VNetB and from VNetB to VNetA. Creating both links will change the state to Connected. So VM2 "cannot" ping VM3

Reciprocal connections When you create a virtual network peering connection in only one virtual network to connect to a peer in another network, you're not connecting the networks together. To connect the networks by using virtual network peering, you have to create connections in each virtual network. https://docs.microsoft.com/en-us/learn/modules/integrate-vnets-with-vnet-peering/2-connect-services-using-vnet-peering therefore is the answer is Yes, No, No, because VM2 cannot Ping VM3 if peering is only from one VNET not bidrectional

Answer is correct. YYN If you dont know networking, please study and test.

Why are there several of you saying you cant ping VM2 to VM3? When you create a peering, the peering is always bidirectional. VNET2 <-> VNET3. You cannot create an unidirectional peering. Ways to achieve unidirectional communication between to VNETs is by using a gateway, or by adding custom rules in NSGs to override the virtual network allow rules

i believer when you do peering, it has to be bi directional. Therefore you should be able to ping vm2 to vm3 and vice versa. Answer is correct. YYN

Option 2 will be : NO Because as per the following MS link peering needs 2 way configuration. Plz check the NOTE option of the configuration image. Link: https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal

I think the given answer is right as it clearly given in question that peering is there from v2 -> v3.. so no doubt that they can talk in one direction.

In order to set this up as shown in example, I connected each according to their resource ID. This way, it doesn't force bidirectional peering. I also made sure that ICMP was allowed in both inbound and outbound rules in NSG, just to be sure, for each VNET. Testing shows the following: 1->2 NO 1->3 YES 2->1 No 2->3 NO 3->1 YES 3->2 NO I suggest testing this on your end to confirm.

When the picture shows both peering VNET1-to-VNET3 and VNET3-to-VNET1, that implies you HAVE to configure bidirectionally. It means the answer is Yes-No-No.

The given answers are correct.. There are 2 options under peering configurations, for example 1. Allow virtual network access from VNET1 to VNET2 2. Allow forwarded traffic from VNET2 to VNET1 Hence you can disable or enable the ping from both the VNETS. From the above question there is a 2 way traffice between VNET1 and VNET3 but there is only 1 way traffic between VNET2 and VNET3 which is possible.

They must be peered both ways for them to ping! YNN

I believe the answer given is correct. Setting up Peering in a real world environment automatically creates a reverse peer, thus allowing back and forward communication. I have done this several times for a client. Thus, it is Yes, yes, no.

It should be Yes, No, No