Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.

Unlimited Access

Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.

Exam AZ-300 topic 1 question 68 discussion

Actual exam question from Microsoft's AZ-300
Question #: 68
Topic #: 1
[All AZ-300 Questions]

You have an Azure subscription that contains three virtual networks named VNet1, VNet2, and VNet3. VNet2 contains a virtual appliance named VM2 that operates as a router.
You are configuring the virtual networks in a hub and spoke topology that uses VNet2 as the hub network.
You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3.
You need to provide connectivity between VNet1 and VNet3 through VNet2.
Which two configurations should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

  • A. On the peering connections, allow forwarded traffic
  • B. Create a route filter
  • C. On the peering connections, allow gateway transit
  • D. Create route tables and assign the table to subnets
  • E. On the peering, use remote gateways
Show Suggested Answer Hide Answer
Suggested Answer: CE ūüó≥ÔłŹ
Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway.
The peered virtual network must have the Use remote gateways checkbox checked when setting up the peering from the other virtual network to this virtual network.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-constraints

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Oz
Highly Voted 4 years, 1 month ago
Sorry answer is AD too bad I cannot edit the previous post.
upvoted 45 times
...
Jaa9
Highly Voted 4 years ago
Correct answer is AD. A: Vnet2 where the NVA is placed need to be allowed to forward traffic from Vnet1 to Vnet3 and vica versa B: User Defined Route (UDR) must be created on each Subnet in Vnet1 and Vnet3 to override system (default) routes and send traffic between these Vnet's via the NVA
upvoted 27 times
Jaa9
4 years ago
D: User Defined Route (UDR) must be created on each Subnet in Vnet1 and Vnet3 to override system (default) routes and send traffic between these Vnet's via the NVA
upvoted 4 times
...
...
Lead_Winner
Most Recent 1 year, 8 months ago
I think the options C and E are correct. Since, the VNet 1 can't communicate directly with the VNet3 and similarly the VNet3 can't communicate with the VNet1 directly, they have to communicate via VNet2 (HUB and Spoke model), therefore Gateway Transit must be implemented on VNet2 and on VNet1 and VNet3 we need to use Remote Gateways. According to my understanding the options A and D is wrong because we enable the forwarding traffic in case of DNS. Similarly, we use user defined routes using Route Table in case of DNS. For example, If the VNet2 was configured as DNS Server then in that case we will implement forwarding traffic and define custom routes on VNet2. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multis2sbgp
upvoted 1 times
...
azurecert2021
2 years, 10 months ago
yes A and D is correct
upvoted 1 times
...
AhmedAL
3 years, 2 months ago
wrong answer... for azure hub and spoke a virtual appliance (not VPN gateway is needed). I think it should be AD
upvoted 3 times
...
ergauravtaneja
3 years, 2 months ago
A, D is correct Exact working in MS documentation. See under "Allow forwarded traffic" Section Ref Link: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering
upvoted 1 times
Himanshu27
3 years, 2 months ago
Yes even I agree with this. Although VNet 2 should have a Virtual Appliance available. I had proved this in lab as per lab question 61 in this same series. Below are my test details. I have been able to prove this in lab this is possible. 1. 2 way peering between a-c and a-b with fwd enabled on both sides. 2. VMA working as NVA with IP FWD in enabled both in azure and at OS. 3. Route table with two routes with below details. a. Address Prefix Adress space of VNETC(traffic B 2 C) Next hop virtual appliance next hop address ip of NVA VM in VNETA b. same as (a) for traffic from C to B 4. on Subnets in B and C choose this route table. That is it, it works. Let me know if you find issues.
upvoted 2 times
...
...
MMohammad
3 years, 2 months ago
The correct answer should be: A&D
upvoted 2 times
...
bc5468521
3 years, 2 months ago
A+D or A+C+D both works, however, A+D is the best performance and less impact; so best answer is A+D
upvoted 3 times
bc5468521
3 years, 2 months ago
sorry, A+D or A+C+E works
upvoted 2 times
...
...
user_name
3 years, 3 months ago
You can also configure spokes to use the hub gateway to communicate with remote networks. To allow gateway traffic to flow from spoke to hub, and connect to remote networks, you must: Configure the peering connection in the hub to allow gateway transit. Configure the peering connection in each spoke to use remote gateways. Configure all peering connections to allow forwarded traffic.
upvoted 2 times
...
ercank
3 years, 4 months ago
A&D is correct same as Question61
upvoted 2 times
...
Harkonnen
3 years, 4 months ago
The answer is INCORRECT!! It dismisses a key piece of information, which is that we will implement a hub and spoke topology (references the documentation on Peerings). The documentation to check is https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke#recommendations . At the beginning of the article, you can see the architecture diagram clearly uses the Gateway to connect to an On-premises infra. This makes option C INCORRECT! The same applies to option E. On- premises infra is not even mentioned. Checking the referenced documentation you can clearly see that ‚ÄúIf you require connectivity between spokes, consider deploying Azure Firewall or an NVA for routing in the hub, and using UDRs in the spoke to forward traffic to the hub.‚ÄĚ There you have the 2 keywords: routing (UDR stands for User Defined Rout) and forwarding.
upvoted 1 times
ct84
3 years, 3 months ago
soo.. A&D?
upvoted 1 times
...
...
Rooh
3 years, 4 months ago
A&D is correct answer
upvoted 2 times
...
zhifu
3 years, 4 months ago
the correct answer should be A & D
upvoted 2 times
...
gboyega
3 years, 5 months ago
A and D
upvoted 5 times
...
SaravanakumarV
3 years, 5 months ago
A & D are the correct answers Please refer "Spoke connectivity" part from the below article. https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke If you require connectivity between spokes, consider deploying Azure Firewall or an NVA for routing in the hub, and using UDRs in the spoke to forward traffic to the hub. The deployment steps below include an optional step that sets up this configuration. In this scenario, you must configure the peering connections to allow forwarded traffic. You can also use a VPN gateway to route traffic between spokes, although this will have impacts in terms of latency and throughput. Also, Azure Firewall or a network firewall appliance provides an additional layer of security.
upvoted 3 times
...
DeveshSolanki
3 years, 5 months ago
A. On the peering connections, allow forwarded traffic D. Create route tables and assign the table to subnets
upvoted 2 times
...
Luiza
3 years, 5 months ago
The correct answer is A & D. Good explanation Matze2ooo. In Hub-Spoke Topology the Gateway enable traffic between Spokes X On-Premises
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...