Exam AZ-700 topic 3 question 2 discussion

The answers depend on some assumptions. Is there actually a vpn gateway sitting in that gateway subnet? If so, is it configured for BGP? If so, then... N - all outbound traffic from VM2 is sent to the internet N - by default, subnets within a vnet can communicate. (I'm assuming that a NSG isn't blocking) Y - all outbound traffic from VM1 is sent to the VPN gateway BGP eliminates the need for a local azure route table.

incorrect, the answer is NYY

Correct answer: NNY Here is why: 1. Traffic from VM2 to the internet is routed through the New-York Site-to-Site VPN connection VM2 is in Subnet2 → uses RT2 → sends 0.0.0.0/0 to the Internet -Traffic goes directly to internet, not via VPN Answer: NO 2. Traffic from VM1 to VM2 is routed through the New-York Site-to-Site VPN connection VM1: Subnet1 (RT1) VM2: Subnet2 (RT2) Both are in the same VNet: Vnet1 VNet peering/connection takes precedence over UDR for intra-VNet traffic -Traffic flows directly in the VNet, not via VPN Answer: NO 3. Traffic from VM1 to the internet is routed through the New-York Site-to-Site VPN connection VM1: Subnet1 → RT1 → Default route (0.0.0.0/0) → VirtualNetworkGateway VNet gateway connected to New York as the default site So yes, internet-bound traffic from VM1 is forced-tunneled via New York VPN. Answer: YES

Correct. N, N, Y

Given answer is correct N- all outbound traffic from VM2 is sent to the internet by default as use route table RT2 N - Since both subnets are part of the same vNET1 hence communicate directly with each other Y - Since VM1 uses RT1 and RT1 has VPNGWY as its default GWY then VM1 uses this for its internet access

NNY Third answer look at: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm.

Correct answer: NNY Check comments

No | No | Yes Yes -> Forced tunneling is carried out by using a virtual private network (VPN) tunnel; this tunnel requires a default site, a local gateway where all the Azure Internet-bound traffic is redirected.

Correct answer N - all outbound traffic from VM2 is sent to the internet by default N - the effective route table show the all the the subnet on the same VNET as a more specific one than the default route and Gateway routes. So subnets within a vnet can communicate can communicate directly. Y - all outbound traffic from VM1 is sent to the VPN gateway

By New York Site-to-site- VPN Connection, I assume whenever the traffic hits the VPN Gateway from the default route in Route1. Am I right? so my answer is NYY

Given answer is correct, since New York local gateway is the default site (forced tunneling) to the VPN https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm (GatewayDefaultSite)

Given answers are wrong. Don't think too hard in trying to draw a logical network diagram in your head. Simply realize NY is 10.9.0.0 (not on any of the route tables). So nothing is routed through the NY. All answers are Q1: No Q2: No Q3: No

I have no idea of creating a logical diagram of this network. Can someone help me out here? Where is NY & Seattle relative to subnet1 & subnet 2. My drawing would be | Vnet1- boundary subnet1(vm1) | subnet2 (vm2) vnet1-boundary | Which way is internet? Which way is VirtualNetworkGateway? Which way is NY Which way is Seattle?

Given answers are correct.

default route is 0.0.0.0/0 internet. RT1 route is UDR therefore VM1 to VM2 is communicates via VPN

NNY. VM1 to VM2 are routed within Vnet1. RT1 and RT2 define default routes.

correct