You are designing a hub-and-spoke network topology. You need to ensure that all outbound internet traffic from the spoke VNets is forced through an Azure Firewall located in the hub VNet. What should you configure?

Answer options:

UDR with 0.0.0.0/0 pointing to Azure Firewall

Network Security Groups (NSGs)

VNet Peering with gateway transit

Azure Front Door

How to approach this question

Identify the routing mechanism to override the default internet path.

Full Answer

A.UDR with 0.0.0.0/0 pointing to Azure Firewall✓ Correct

A User Defined Route (UDR) with 0.0.0.0/0 pointing to the Azure Firewall private IP

A UDR attached to the spoke subnets with a 0.0.0.0/0 route pointing to the firewall's private IP forces all internet traffic through the hub. Pillar: Security.

Common mistakes

Thinking NSGs can route traffic.

Question 51 All questions Question 53

Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 7

55 questions · hints · full answers · grading

More questions from this exam

Q01CASE STUDY: Contoso migrating 500 servers to Azure. RTO 2h, RPO 15m, GDPR compliance, 10Gbps Expr...Hard Q02CASE STUDY: Contoso migrating 500 servers to Azure. RTO 2h, RPO 15m, GDPR compliance, 10Gbps Expr...Medium Q03CASE STUDY: Contoso migrating 500 servers to Azure. RTO 2h, RPO 15m, GDPR compliance, 10Gbps Expr...Hard Q04CASE STUDY: Contoso migrating 500 servers to Azure. RTO 2h, RPO 15m, GDPR compliance, 10Gbps Expr...Medium Q05CASE STUDY: Contoso migrating 500 servers to Azure. RTO 2h, RPO 15m, GDPR compliance, 10Gbps Expr...Hard

View all 55 questions →