CCNA Virtual Network Questions

The hub and spoke VNets have overlapping address ranges (10.1.0.0/16), which prevents peering. Enabling gateway transit does not resolve address overlap; peering requires non-overlapping address spaces.

Adding another subnet inside the spoke VNet does not resolve the overlapping address space issue; the hub and spoke VNets still have conflicting IP ranges, which prevents successful peering.

The question is about resolving overlapping address spaces between hub and spoke VNets for successful peering. Creating a network security group (NSG) on the spoke subnet does not address the address overlap issue; NSGs control traffic filtering, not IP address conflicts.

Azure does not ignore user-defined routes for storage traffic; UDRs apply to all traffic, including storage. The issue is that a more specific route (e.g., to the storage service tag) overrides the 0.0.0.0/0 route.

NSG outbound rules do not override user-defined routes; they are evaluated after routing decisions. Routes determine the next hop, and NSGs filter traffic based on that route, but they cannot change the path.

A public IP address is not required for a user-defined route to take effect; the route applies to all traffic from the subnet regardless of public IP assignment.

Connection troubleshoot tests end-to-end connectivity between a source and destination VM, but it does not identify which specific NSG rule is blocking traffic; it only reports connectivity success or failure.

Next hop identifies the next hop IP address and route for a packet, but it does not evaluate NSG rules to determine if traffic is allowed or blocked.

Packet capture captures raw network packets for deep analysis but does not identify which specific NSG rule is blocking traffic; it requires manual inspection of captured data and does not correlate with NSG rules.

Moving a gateway NIC into a normal workload subnet is not supported; VPN gateway NICs must reside in the GatewaySubnet. This action would break the gateway deployment.

Creating a private endpoint inside GatewaySubnet does not increase the number of available IP addresses for the VPN gateway; private endpoints consume IP addresses from the subnet, making the shortage worse.

Enabling BGP does not reduce the number of IP addresses required by the VPN gateway; BGP is a routing protocol that exchanges routes, not a method to change IP address consumption. The gateway still needs the same number of IP addresses for its instances.

Changing the deny rule source from VirtualNetwork to Internet would block all internet traffic, but the issue is that the deny rule with priority 65000 is blocking traffic from the web tier (which is within the virtual network) to the app tier. The source should remain VirtualNetwork to allow internal traffic; the problem is the rule priority.

Associating the NSG with the VM NIC instead of the subnet would not resolve the issue because the NSG rules are evaluated at the subnet level for traffic between subnets. The problem is that the deny rule with priority 100 is blocking traffic from the web tier subnet to the app tier subnet; moving the NSG to the NIC would not change the subnet-level rule evaluation.

Replacing the ASG destination with the subnet address range would remove the application security group's ability to dynamically track the web tier's VMs, breaking the intended rule that only the web tier (ASG members) can reach the app tier on TCP 8443.

A route table controls network traffic routing (next hop) between subnets and on-premises networks, not traffic filtering based on IP, port, and protocol. It does not allow or deny traffic; it directs packets.

A private DNS zone is used for custom domain name resolution within a virtual network, not for filtering traffic based on IP, port, or protocol.

Azure Advisor provides recommendations for best practices in cost, security, reliability, and performance, but it does not control traffic flow based on IP, port, or protocol.

User-defined routes control traffic routing, not security filtering. The question requires allowing traffic on TCP 443, which is a security rule function, not a routing decision.

Option B is wrong because using subnet address prefixes in an NSG rule would allow traffic between any VMs in the two subnets, not just between the specific frontend and backend tiers. The requirement is to restrict traffic to only the frontend and backend VMs, not all VMs in the subnets.

VNet peering connects entire virtual networks, not individual tiers within the same subnet. The question specifies frontend and backend VMs are in the same subnet, so peering is irrelevant and cannot restrict traffic between tiers.

Application security groups are used to group virtual machines for network security rule application, not for Azure role assignment. Azure roles are assigned via Azure RBAC, not ASGs.

Service tags are Microsoft-managed labels for Azure services, not custom labels created by users for their own subscriptions.

Service tags do not create private IP addresses; they represent a group of IP address prefixes for a given Azure service, which Microsoft manages and updates automatically.

This rule uses static private IPs, so it fails to automatically include future VM scale-outs, violating the requirement for automatic inclusion.

Route tables control IP routing between subnets, not traffic filtering. They cannot enforce application-layer allow rules like TCP port 8443, and they don't integrate with application security groups for automatic scale-out inclusion.

Azure Firewall application rules are for outbound HTTP/S traffic from applications, not for inbound network filtering between VMs. This question requires an NSG rule, not a firewall rule, and the requirement is for inbound connectivity from web to app tier.

A service endpoint does not assign a private IP to the storage account; it only allows traffic from the VNet to the storage account's public endpoint. The requirement is for the app to access the storage account by a private IP address, which service endpoints cannot provide.

The storage account has public network access disabled, so a firewall rule allowing the VNet is irrelevant because the storage account cannot be accessed over the public endpoint at all. Additionally, a public DNS record update would not provide a private IP address for the storage account.

A SAS token provides delegated access to a storage account using the storage account's public endpoint, but the question states public network access is disabled and requires a private IP address. SAS tokens do not enable private IP connectivity.

Azure VNet peering requires non-overlapping address spaces; enabling gateway transit does not resolve address overlap, and peering will still fail.

Private endpoints are used for secure access to PaaS services over a private IP, not for connecting two VNets; they cannot replace VNet peering for inter-VNet connectivity.

Azure VNet peering requires non-overlapping address spaces. Adding a second prefix to the spoke VNet does not resolve the existing overlap with the hub's 10.40.0.0/16, and the overlapping range (10.40.128.0/17) remains, causing peering to fail.

Gateway transit enables a spoke to use the hub's VPN/ExpressRoute gateway, but it does not resolve IP address overlap. Peering fails due to conflicting address spaces (10.40.0.0/16 and 10.40.128.0/17), not gateway configuration.

Peering fails due to overlapping address spaces (10.40.0.0/16 and 10.40.128.0/17), not DNS resolution. DNS records do not resolve IP address conflicts; Azure VNet peering requires non-overlapping address spaces.

An additional public IP address is not needed because the private endpoint already provides a private IP for the storage account; the goal is name resolution to that private IP, not public connectivity.

An Azure Firewall policy controls inbound/outbound traffic filtering and does not provide DNS resolution or name-to-IP mapping for private endpoints.

A site-to-site VPN gateway connection requires a gateway and routes traffic over the internet or ExpressRoute, not directly over private IPs, and incurs additional cost and complexity.

Service endpoints secure Azure service access from a VNet but do not enable direct private IP communication between two VNets; they only provide a direct path to PaaS services, not VNet-to-VNet connectivity.

Route tables with default routes to each VNet do not enable direct private IP communication between VNets; they only control traffic within a VNet or to forced-tunneling destinations. VNet peering is required for direct connectivity.

The deny rule at priority 150 explicitly blocks traffic from the Internet, so changing the allow rule's source from Internet to Any does not override the deny; the deny still applies because it has higher priority (lower number).

The issue is that the deny rule at priority 150 blocks inbound HTTPS from the Internet before the allow rule at priority 200 can be evaluated. Adding a route table does not affect NSG rule evaluation order; it only influences traffic routing, which is not the problem here.

Associating an application security group (ASG) with the VM does not change the NSG rule evaluation order; the deny rule at priority 150 still blocks inbound HTTPS from the Internet, regardless of ASG membership.

Enabling anonymous blob access would allow any internet user to access the storage account without authentication, which violates the requirement to keep the storage account secure and not open to the entire internet.

Moving a storage account to the Archive tier does not affect network security; it only changes the access tier for cost optimization, leaving the account still accessible over the internet if not otherwise restricted.

Applying a delete lock prevents accidental deletion of the storage account but does not provide secure network access from a VM to the storage account. It does not restrict traffic to a specific subnet or private IP.

Azure uses the most specific route prefix (longest prefix match) for traffic, not the order of creation. The /24 route is more specific than the /8 route, so the virtual network gateway is used.

Azure uses longest prefix match for routing, not default system routes. The destination 10.1.1.5 matches the more specific /24 route, so the virtual network gateway is used, not the Internet.

Azure uses the most specific route (longest prefix match) for traffic, so the /24 route to the virtual network gateway is chosen over the /8 route. Overlapping routes do not cause Azure to ignore them; they are evaluated based on prefix length.

Creating a second private endpoint in VNet-B for the same storage account is unnecessary and violates the principle of using a single private endpoint with DNS resolution. The issue is DNS resolution, not connectivity; the VM can already reach the storage account via private IP, but name resolution fails because the private DNS zone is not linked to VNet-B.

Enabling a service endpoint on VNet-B and removing the private endpoint would break private connectivity for VNet-A and does not resolve DNS resolution; service endpoints do not provide private DNS integration.

User-defined routes (UDRs) cannot override DNS resolution; they only control network traffic flow. The issue is name resolution returning the public IP, not routing, so a UDR won't fix the DNS query.

Service endpoints do not provide private IP resolution; the storage account's public DNS name still resolves to a public IP. The question requires private IP resolution without changing application code, which only a private endpoint with a private DNS zone can achieve.

An account SAS token provides delegated access to the storage account using the public endpoint, but the question requires private IP access and private DNS resolution, which a SAS token cannot achieve.

Option D allows trusted Microsoft services to bypass the firewall, but it does not provide private IP connectivity or private DNS resolution. The requirement is for the storage account to be accessed over a private IP address and resolve to a private address inside the VNet, which only a private endpoint with private DNS zone can achieve.

Route tables control network traffic flow based on IP addresses, but they do not affect DNS resolution. The issue is that the storage account's public DNS name is still resolving to the public IP instead of the private endpoint's private IP, which requires DNS configuration, not routing.

Service endpoints do not affect DNS resolution; they only provide direct connectivity to Azure services over the Azure backbone network. The VM still resolves the storage name to the public IP address, so the private endpoint address is not used.

Assigning a public IP to the private endpoint subnet does not affect DNS resolution; private endpoints use private IPs, and DNS resolution to the private IP requires a private DNS zone linked to the VNet.

A site-to-site VPN requires a VPN gateway and connects on-premises networks to Azure, not two Azure virtual networks in the same region. It does not provide private communication over the Azure backbone without a gateway.

Network security groups (NSGs) filter traffic but do not establish connectivity between virtual networks; they are not a connectivity solution.

An Azure Firewall policy alone does not enable private connectivity between virtual networks; it only controls traffic filtering. To allow private communication over the Azure backbone, you need virtual network peering or a VPN gateway, not just a firewall policy.

NetFlow is primarily used for monitoring and analyzing network traffic rather than collecting log messages. It provides flow data but does not centralize log messages for review.

DHCP relay is primarily used to forward DHCP packets between clients and servers across different subnets, not for collecting log messages. It does not provide centralized logging capabilities for interface changes, warnings, or errors.

Port security is a feature used to control access to a switch port by limiting the devices that can connect, but it does not collect or centralize log messages for review. It focuses on securing network access rather than log management.

A private endpoint assigns the storage account a private IP from the subnet, removing public endpoint access entirely, which contradicts the requirement that the storage account remain reachable through its public endpoint.

A site-to-site VPN connects on-premises networks to Azure, not a subnet to a storage account, and it routes traffic over the internet or VPN gateway, not ensuring traffic stays on the Azure backbone.

An application security group (ASG) is used to group virtual machines and apply network security rules based on that group, not to restrict access to a storage account from a subnet. It cannot limit traffic to the Azure backbone or provide subnet-level access control to a storage account's public endpoint.

The issue is DNS resolution, not network connectivity. NSG rules control traffic flow, but the spoke VNet still uses its default Azure DNS, not the hub's DNS server. Adding NSG rules for port 53 does not change the DNS server configuration.

A private endpoint is used to securely access Azure PaaS services (like Azure SQL, Storage) over a private IP within a VNet, not to configure DNS resolution for VMs. It does not set a custom DNS server for a VNet.

Enabling remote gateways on the spoke peering allows the spoke VNet to use the hub's VPN/ExpressRoute gateway for outbound connectivity, but it does not configure DNS settings. The spoke VMs still need a custom DNS server address to resolve internal host names.

In Azure, a spoke VNet does not automatically use the hub's VPN gateway just by creating peering. You must explicitly configure gateway transit by enabling 'Allow gateway transit' on the hub peering and 'Use remote gateways' on the spoke peering.

The settings are reversed: 'Use remote gateways' must be enabled on the spoke peering (from spoke to hub), and 'Allow gateway transit' on the hub peering (from hub to spoke). Option B swaps these, which would not allow the spoke to use the hub's VPN gateway.

Service endpoints are used for secure access to Azure services (like Storage or SQL) from a VNet, not for connecting to on-premises networks via VPN. They do not provide IP-level routing or gateway transit capabilities.

The question requires browser-based RDP/SSH access without client VPN on each laptop. VPN Gateway with point-to-site requires a VPN client on each laptop, violating the 'no client VPN' constraint.

A public load balancer with inbound NAT rules would require the VMs to have public IPs or be reachable via the load balancer's frontend IP, which still exposes RDP/SSH ports (3389/22) to the internet, violating the security team's restrictions.

A NAT gateway provides outbound internet access for VMs with private IPs, but it does not enable inbound RDP/SSH connections from the internet. The question requires browser-based inbound access, which NAT gateway cannot provide.

NSG rules are evaluated by priority order, not by specificity. The priority 100 deny rule matches all traffic from Internet, including 203.0.113.0/24, so it is applied before the priority 200 allow rule, resulting in denial.

NSG rules are stateless and apply to all traffic entering the subnet, regardless of whether the VM has a public IP. The deny rule at priority 100 blocks TCP 443 from Internet (any source), so the tester's request is denied irrespective of the VM's public IP.

Default NSG rules have lower priority than custom rules and do not override them; the priority 100 deny rule explicitly blocks the traffic before any default rule could apply.

The issue is that the Deny-All-Inbound rule at priority 200 blocks HTTPS traffic before the Allow-HTTPS-Admin rule at priority 250 is evaluated. Changing the protocol to Any does not affect the priority order; the deny rule still takes precedence.

A NAT gateway provides outbound internet connectivity for private subnets, but does not affect inbound traffic filtering by NSG rules. The issue is that the Deny-All-Inbound rule at priority 200 blocks HTTPS before the Allow-HTTPS-Admin rule at priority 250 is evaluated.

Service endpoint policies control access to Azure services (like Storage or SQL) from a subnet, not inbound HTTPS traffic to a VM. They do not affect NSG rule processing or priority, so they cannot resolve the issue where a higher-priority Deny-All rule blocks the admin's HTTPS.

VNet peering is non-transitive; a peered connection between VNet-A and the hub, and between VNet-B and the hub, does not automatically enable direct traffic between VNet-A and VNet-B through the hub.

Overlapping CIDR blocks are not allowed for VNet peering even if VNets are in separate resource groups; peering requires non-overlapping address spaces.

In Azure, VNet peering is non-transitive; traffic from one spoke to another must be explicitly routed through a hub, typically using a network virtual appliance or gateway transit. A VPN gateway in the hub does not automatically route spoke-to-spoke traffic without additional configuration like user-defined routes.

This rule allows inbound traffic from the Internet to any virtual network resource on TCP 8080, which is overly permissive and does not restrict access to only the web tier reaching the app tier.

The rule specifies Source: AppASG and Destination: WebASG, which is the reverse direction (app to web) instead of allowing web tier to reach app tier on TCP 8080.

Priority 350 is higher than the default deny rule (65000) but lower than the required priority to override any existing rules; however, the question does not specify a need for a specific priority, so priority 250 is acceptable. The real issue is that option D is identical to the correct answer A, so it is not wrong; the question likely expects priority 250 as the correct one, but D is also correct. Actually, the question states correct answer is A, so D is wrong because it has a higher priority number (350) which means lower priority, potentially being overridden by other rules with lower numbers.

The issue is DNS resolution, not routing. The VM can already reach the private endpoint by IP, so adding a route table does not help resolve the storage account name to the private endpoint FQDN.

Gateway transit is used to allow a peered VNet to use the hub's VPN/ExpressRoute gateway for connectivity to on-premises networks, not for DNS resolution of private endpoints. The issue here is DNS resolution, not routing or gateway access.

The issue is DNS resolution, not network traffic. The VM can already reach the private endpoint by IP, so NSG rules for DNS traffic are irrelevant because DNS queries are sent to the Azure-provided DNS (168.63.129.16) or a custom DNS server, not to the storage account's IP.

The question requires traffic to 172.16.0.0/12 to be sent to a firewall, not all traffic. A 0.0.0.0/0 route would send all internet-bound traffic to the firewall, which is not the requirement and would break internet connectivity.

The next hop must be a virtual appliance (firewall) at 10.1.1.4, not a virtual network gateway. A virtual network gateway is used for VPN or ExpressRoute connections, not for routing to a firewall.

Setting next hop to 'None' drops traffic to 172.16.0.0/12 instead of forwarding it to the firewall at 10.1.1.4, which violates the requirement that all traffic to that range must go through the firewall.

A private endpoint disables public endpoint access, but the question requires the storage account to remain reachable through its public endpoint for the on-premises server.

A SAS token restricts access to specific resources or operations, not network-level access. It cannot enforce that traffic originates from a specific subnet; the SAS token can be used from any IP address that has the token.

Assigning Storage Blob Data Reader to the subnet grants read access to blob data but does not control network access; the storage account's public endpoint would still be accessible from any IP, violating the requirement to restrict access to only one Azure subnet.

A service endpoint does not assign a private IP to the storage account; it only provides direct connectivity from the subnet to the service over the Azure backbone. Public network access must be disabled to meet the requirement, but service endpoints do not disable public access.

A shared access signature (SAS) provides time-limited access but does not disable public network access or assign a private IP. IP-based firewall rules still expose the storage account to the internet, failing the requirement for private IP and disabled public access.

A route table forces traffic through a gateway but does not provide a private IP for the storage account within the VNet, nor does it disable public network access. It also cannot enforce that the storage account is reachable only from that VNet.

Additional peering links between the hub and both spokes do not enable spoke-to-spoke communication through the hub; they only create direct peering, which still requires routing configuration (like UDRs) to forward traffic through the hub for centralized inspection.

A private endpoint in the hub allows private connectivity to a specific Azure service (e.g., Azure SQL) from the spokes, but it does not enable inter-spoke routing or centralized inspection of traffic between spokes.

Service endpoints allow private access from a VNet to Azure PaaS services, not routing traffic between VNets. They do not enable spoke-to-spoke communication through the hub.

The issue is DNS resolution, not outbound connectivity. Adding an outbound NSG rule for TCP 1433 to the internet does not change the DNS resolution of the SQL server name from public IP to private IP, so the connection will still fail because public network access is disabled.

Assigning a public IP to a private endpoint is not supported; private endpoints use private IPs from the VNet. It would not resolve the DNS resolution issue in peered VNet B.

The issue is DNS resolution, not outbound internet DNS. The VM cannot resolve the storage account name because the private endpoint's private DNS zone is not linked to the peered VNet. An NSG rule allowing outbound DNS to 8.8.8.8 would not help because the VM uses Azure DNS (168.63.129.16) for name resolution, and the private endpoint requires a custom DNS zone.

A Recovery Services vault is used for backup and disaster recovery, not for network connectivity or DNS resolution. It does not enable a VM in a peered VNet to resolve a storage account's private endpoint.

A private endpoint NIC does not require a public IP address; it uses a private IP from the VNet. Adding a public IP would not resolve the name resolution issue, as the problem is DNS resolution, not public connectivity.

The proposed spoke address space 10.60.1.0/24 overlaps with the hub's 10.60.0.0/16, causing IP conflicts when peered. Azure requires non-overlapping VNet address spaces for peering.

Creating a private endpoint does not separate routing tables; it provides private connectivity to Azure PaaS services. The issue here is overlapping IP address spaces between hub and spoke, which would prevent VNet peering, not routing separation.

Gateway transit is configured on the hub peering to allow the spoke to use the hub's VPN gateway for on-premises connectivity, but it is not a prerequisite for creating the spoke VNet. The spoke must be created first, then peered, and gateway transit can be enabled afterward.

VNet peering fails due to overlapping address spaces, not subnet mask size. Changing the subnet mask does not resolve address space overlap.

VNet peering does not require route tables; overlapping address spaces are the issue here, not routing.

Enabling a service endpoint does not resolve VNet peering failures caused by overlapping address spaces; service endpoints are used for secure access to Azure services, not for VNet connectivity.

A service endpoint secures Azure service traffic (e.g., to Azure Storage) to a subnet, not TCP traffic between VMs. It does not allow dynamic IP-based rules for backend VMs.

Route tables control traffic routing, not security filtering. A route table with a next hop of Virtual network gateway would redirect traffic to a VPN gateway, which does not solve the need to allow TCP 8443 traffic to dynamically changing backend IPs without updating NSG rules.

Private endpoints are used to securely access Azure PaaS services over a private IP address, not to allow VMs in one subnet to communicate with VMs in another subnet within the same VNet. They do not solve the problem of dynamic private IP addresses for backend VMs.

Option A (10.50.128.0/17) overlaps with the hub's address space 10.50.0.0/16, which would prevent successful peering and cause IP conflicts with on-premises connections.

Option B (10.51.0.0/16) overlaps with the hub's address space 10.51.0.0/16 shown in the exhibit, preventing successful peering and connection to on-premises without IP overlap.

Option D (10.50.0.0/24) is a subset of the hub's address space 10.50.0.0/16, which would cause an IP overlap when peering, violating the requirement for no overlap.

Azure VPN Gateway requires a VPN client installed on admin laptops to establish a site-to-site or point-to-site connection, which conflicts with the security team's requirement of no VPN client installation.

Azure Load Balancer distributes traffic to VMs but does not provide inbound RDP/SSH connectivity without public IPs or a jump box; it operates at the transport layer and cannot replace a secure bastion host for browser-based access.

A network security group (NSG) with RDP and SSH rules controls inbound traffic at the subnet or NIC level, but it does not provide browser-based connectivity without public IPs or a VPN. The VMs lack public IPs, so NSG rules alone cannot enable access from the Azure portal.

Private endpoints are used for secure access to Azure PaaS services (e.g., Storage, SQL) over a private IP within a VNet, not for establishing site-to-site VPN connectivity between on-premises and Azure.

Microsoft peering is used for ExpressRoute, not site-to-site VPN. A classic site-to-site tunnel requires a VPN gateway with a public IP and IKE/IPsec settings, not peering.

The peering fails because the spoke VNet (10.20.1.0/24) overlaps with the hub VNet (10.20.0.0/16). Enabling gateway transit does not resolve address space overlap; it only allows the spoke to use the hub's VPN gateway for connectivity to on-premises networks.

Adding a route table to the spoke subnet does not resolve the address overlap issue. VNet peering requires non-overlapping address spaces; routing cannot fix overlapping IP ranges.

The peering failure is due to overlapping address spaces (10.20.0.0/16 hub vs 10.20.1.0/24 spoke), not DNS resolution. Configuring a custom DNS server does not resolve the IP address overlap, which prevents peering from being established.

In Azure, NSG rules are evaluated in order of priority, and a deny rule in either the subnet or NIC NSG will block traffic, regardless of an allow rule in the other NSG. Subnet NSGs do not override NIC NSGs; both are evaluated, and the most restrictive rule applies.

Service tags do not bypass NSG rules; NSGs are evaluated in order of priority, and a deny rule in the NIC NSG will block traffic regardless of the subnet NSG allow rule.

In Azure, NSG rules are evaluated in order of priority, and a deny rule in either the subnet or NIC NSG will block traffic. Route tables do not affect NSG rule evaluation; they only influence traffic routing.

Creating a service endpoint on VNet-B does not enable private DNS resolution for the storage account; it only allows traffic to the storage account's public endpoint via the Azure backbone network. The question requires resolving the storage account name to a private IP address, which requires linking the private DNS zone to VNet-B.

Assigning a public IP to the private endpoint does not affect DNS resolution for the storage account; it only exposes the endpoint to the internet, which defeats the purpose of private connectivity and does not make VM-B resolve the name to the private IP.

Adding a route table with a next hop to the storage account does not affect DNS resolution; it only controls network traffic routing. The issue is that VM-B cannot resolve the storage account name to the private IP address, which requires DNS configuration, not routing.

The next hop type 'Internet' would route traffic destined for 172.16.0.0/16 to the internet, not to the on-premises network via the VPN gateway, breaking connectivity.

An NSG rule controls traffic at the network interface or subnet level based on ports and protocols, but it cannot route traffic to a VPN gateway. The issue is a missing route for 172.16.0.0/16, not a firewall rule.

Service endpoints are used to secure Azure service access to specific virtual networks, not to route traffic to on-premises networks. They do not affect routing to on-premises destinations like 172.16.0.0/16.

Adding a second NAT gateway does not resolve the conflict; the 0.0.0.0/0 user-defined route with next hop Virtual appliance still overrides the NAT gateway for outbound internet traffic, because UDRs have higher priority than the default route to the NAT gateway.

Disabling NSGs does not affect route selection; the NAT gateway is not used because the user-defined route for 0.0.0.0/0 with next hop Virtual appliance overrides the default route to the NAT gateway.

Disabling gateway route propagation does not affect the priority of a NAT gateway over a user-defined route (UDR). The 0.0.0.0/0 UDR with next hop Virtual Appliance still has higher priority than the NAT gateway's default route, so traffic continues to use the NVA.

Keeping the 0.0.0.0/0 UDR to the virtual appliance forces internet traffic through the appliance, bypassing the NAT gateway. The NAT gateway requires the subnet's default route to be 0.0.0.0/0 with next hop 'Internet' to handle outbound traffic directly.

Changing the route next hop to Virtual network gateway would route traffic to a VPN gateway or ExpressRoute gateway, which does not provide NAT gateway functionality for consistent public IP. The NAT gateway must be associated with the subnet, and the UDR to the appliance must be removed to allow direct internet egress.

An NSG outbound rule allows traffic but does not provide a consistent public source IP; NAT gateway is required for that. The NSG cannot replace the route table change needed to bypass the virtual appliance.

Service endpoints do not provide private IP resolution; the blob endpoint still resolves to a public IP, and public network access is disabled, so the firewall allow rule would be ineffective.

This option exposes the storage account to the public internet by allowing access from a specific public IP, which contradicts the requirement to keep the service non-public and resolve the blob endpoint to a private IP.

An NSG rule controls traffic at the network layer but does not provide private connectivity or DNS resolution to a private IP for the blob endpoint. The question requires the blob endpoint to resolve to a private IP, which NSGs cannot achieve.

A private endpoint resolves DNS for a specific Azure service (e.g., Storage, SQL) within a VNet, not for custom internal hostnames like web01.corp.contoso.local hosted on a VM DNS server.

Gateway transit is used to route traffic through a VPN gateway or ExpressRoute gateway in the hub to on-premises or other networks, not to propagate DNS server settings across a peering. DNS server configuration is a VNet property, not inherited via peering.

The question states IP connectivity already works, so NSG rules for port 53 are unnecessary. The issue is DNS resolution configuration, not network security.

Connection troubleshoot tests end-to-end connectivity between a source and destination, but it does not show the effective route table applied to a specific NIC. The question asks to confirm which route Azure will select, which requires viewing the effective routes, not testing connectivity.

IP flow verify tests connectivity by checking if traffic is allowed or denied by security rules, but it does not show the actual route selected from multiple possible routes, including propagated routes. The question asks for confirming which route wins, which requires effective routes.

Packet capture captures raw network traffic but does not analyze routing tables or show which route is selected for a specific destination. It cannot confirm the effective route on a VM's NIC.

A site-to-site VPN connects on-premises networks to Azure via the internet, not for private VNet-to-VNet communication within the same region over the Microsoft backbone.

A network security group (NSG) filters traffic at the subnet or NIC level but does not establish connectivity between virtual networks; it cannot enable private communication across VNets.

Azure Policy assignment is used to enforce compliance rules across resources, not to establish network connectivity. It cannot enable private communication between virtual networks.

Changing the deny-all rule at priority 200 to allow TCP 8443 would allow traffic from all sources, not just the web tier, violating the requirement to restrict access to ASG-Web only.

Route tables control traffic routing between subnets, not firewall rules. The question involves Network Security Group (NSG) rules, which filter traffic at the subnet or NIC level; adding a route table entry does not affect NSG allow/deny decisions.

Removing the AzureLoadBalancer rule would not fix the issue because that rule is likely needed for Azure Load Balancer health probes, and it does not override web tier traffic; the deny-all rule at priority 200 is blocking the traffic.

Private endpoint assigns a private IP to the storage account, making it accessible only from the virtual network, not from its public endpoint. The question requires the storage account to remain reachable through its public endpoint, which private endpoint does not allow.

Azure Bastion provides secure RDP/SSH connectivity to virtual machines without exposing public IPs, but it does not control network access to storage accounts or restrict access to a subnet.

VPN Gateway is used for site-to-site or point-to-site encrypted connectivity over the internet, not for restricting access to a public endpoint from a specific subnet. It does not provide the subnet-level service endpoint policy needed to allow only that subnet to reach the storage account's public endpoint.

Increasing the deny rule priority from 200 to 300 makes it a lower priority (higher number), which does not resolve the issue because the deny rule still has a higher priority than the allow rule (which is at priority 100). The HTTPS test is denied because the deny rule at priority 200 is evaluated before the allow rule at priority 100.

The Allow-HTTPS-Admin rule already uses protocol TCP (HTTPS). Changing it to 'Any' would not resolve the issue because the deny rule with priority 200 is blocking traffic before the allow rule is evaluated. The problem is rule priority, not protocol.

Assigning a public IP address to the VM does not affect Azure Firewall rules; the HTTPS test is denied by a firewall rule with priority 200, and the VM's IP assignment does not bypass firewall policies.

Azure VPN Gateway provides site-to-site or point-to-site VPN connectivity, not browser-based RDP/SSH access to a VM without a public IP. It requires a public IP on the gateway and does not offer a native browser-based administrative interface.

Assigning a public IP address to the VM would expose it directly to the internet, which contradicts the requirement for browser-based administrative access without a public IP. Azure Bastion provides secure RDP/SSH access via the Azure portal without a public IP.

Azure Load Balancer distributes incoming network traffic across multiple VMs, but it does not provide browser-based administrative access (RDP/SSH) to a VM without a public IP. It requires backend VMs to have routeable IPs or be reachable via other means.

A user-defined route (UDR) controls traffic routing within a virtual network, not inbound access control. It cannot allow or deny traffic to a VM; that is the function of network security groups (NSGs).

VNet peering connects two virtual networks, but it does not allow inbound internet traffic to a VM. Internet access requires an NSG rule or a public IP with proper security, not peering.

A private endpoint is used to securely connect to Azure PaaS services (like Azure SQL, Storage) over a private IP address, not to allow inbound internet traffic to a VM. It does not expose a VM to the internet.

Azure does not automatically route overlapping prefixes; overlapping address spaces prevent VNet peering from being established. Creating the peering without resolving the overlap will fail.

Route tables cannot resolve address space overlap; Azure VNet peering requires non-overlapping address spaces, and forcing traffic through a firewall does not change the underlying conflict.

Private endpoints are used for secure access to PaaS services over a private IP, not for resolving VNet peering address overlap. They do not bypass the requirement for non-overlapping address spaces in peering.

A route table with a default route to the on-premises network is not required for VPN gateway deployment validation; the gateway automatically handles routing. The missing resource is a public IP address, which is mandatory for the gateway to establish connectivity.

A private endpoint is used for secure access to Azure PaaS services over a private IP, not for VPN gateway connectivity. The VPN gateway requires a public IP for establishing the IPsec tunnel with the on-premises VPN device.

Azure VNet peering requires non-overlapping address spaces. Overlapping ranges (10.20.0.0/16 and 10.20.128.0/17) cannot be directly peered; route tables cannot resolve the conflict because Azure peering does not support overlapping prefixes.

Gateway transit does not resolve overlapping IP address ranges; it only allows one VNet to use the other's VPN gateway for connectivity to on-premises networks. Overlapping ranges prevent peering from being established at all.

Private endpoints provide secure access to Azure PaaS services from a VNet, but they do not resolve IP address overlap between two VNets. Peering requires non-overlapping address spaces, and private endpoints cannot route traffic between overlapping ranges.

A public Standard Load Balancer with a public frontend IP would make the application reachable from the internet, violating the requirement that the application must not be reachable from the internet.

A NAT gateway provides outbound internet connectivity for private subnets, not inbound load balancing. The requirement is to balance traffic across two VMs from internal sources only, which a NAT gateway cannot do.

A network security group rule allowing TCP 443 from the internet would expose the application to the internet, violating the requirement that it must not be reachable from the internet.

Removing the default route would cause all outbound traffic, including the server's update traffic, to use system routes, which would not route through the firewall but also would not allow the server to directly reach 40.90.10.25 without a specific route. This fails to meet the requirement that only the server's traffic to 40.90.10.25 bypasses the firewall.

A service endpoint does not bypass the firewall; it only provides direct connectivity to Azure services over the Azure backbone, not to a specific public IP like 40.90.10.25. The requirement is to allow direct internet access for a specific IP, which service endpoints cannot achieve.

A NAT gateway provides outbound internet access with source network address translation, but it does not allow selective bypass of the firewall for specific destinations; all traffic would still follow the UDR unless a more specific route is added.

The question requires the spoke to use the hub's VPN gateway, which is achieved by enabling 'Use remote gateways' on the spoke peering, not 'Allow forwarded traffic'. 'Allow forwarded traffic' permits the hub to forward traffic from other networks to the spoke, but does not allow the spoke to use the hub's gateway.

Deleting the peering and creating a VPN gateway in the spoke would bypass the hub's existing VPN gateway, which contradicts the requirement to use the hub's gateway for on-premises connectivity. This would also incur additional cost and management overhead.

Service endpoints secure Azure service access from a virtual network to specific Azure services (e.g., Azure Storage) by forcing traffic over the Microsoft backbone. They do not enable a spoke VNet to use a hub's VPN gateway for on-premises connectivity; that requires the 'Use remote gateways' peering setting.

Moving the NSG to the web subnet does not resolve the issue because the API VM NICs are not in ASG-Api, so the destination ASG membership is not recognized. The NSG rule requires the destination to be ASG-Api, but the API VMs are not members.

ASGs (Application Security Groups) have no port restrictions; they work with any TCP/UDP port. Changing the port to 443 is unnecessary and does not address the root cause—the API VM NICs are not in ASG-Api.

Service endpoints extend VNet identity to Azure service resources, not to NSG rules. They do not affect NSG destination matching; the NSG rule still requires the destination ASG to contain the target NICs.

NSGs filter traffic but do not resolve overlapping IP address spaces; peering requires non-overlapping ranges to establish routing.

Renaming a virtual network does not change its address space; Azure identifies VNets by their address ranges, not names, so the overlap error persists.

Gateway transit does not resolve address space overlap; it only enables a VPN gateway in one VNet to route traffic to on-premises or other VNets via the peered VNet. Overlapping IP ranges prevent peering from being established at all.

Azure Load Balancer operates at Layer 4 (transport layer) and distributes traffic based on IP address and port, not HTTP request attributes like URL path. It cannot perform content-based routing.

Traffic Manager operates at the DNS level, distributing traffic based on domain name resolution, not HTTP request attributes like URL path. It cannot inspect or route based on HTTP-level details.

Network Watcher is a monitoring and diagnostics service for Azure networks, not a traffic distribution service. It cannot route or load balance HTTP traffic based on request attributes.

The NIC NSG rule at priority 100 already allows traffic from WebASG to AppASG on TCP 8443, but the subnet NSG deny rule at priority 200 blocks it. Since subnet NSG rules are evaluated before NIC NSG rules, traffic is denied regardless of NIC rule priority. Moving the NIC rule to a higher priority does not override the subnet deny rule.

The subnet NSG deny rule blocks TCP 8443 from VirtualNetwork to any destination. Replacing it with a rule for AzureLoadBalancer service tag would allow health probe traffic from the load balancer, but it would not allow traffic from WebASG to AppASG because the deny rule is removed, potentially allowing all virtual network traffic, which violates the requirement to keep other traffic blocked.

Removing the backend VM from AppASG would break the application security group association, preventing the NIC NSG rule from matching traffic from WebASG. Additionally, allowing traffic by subnet only would permit all VMs in the subnet, violating the requirement to allow only the web tier.

Using individual private IP addresses as the source would require updating the NSG rule whenever a backend VM's IP changes, failing the requirement for the rule to keep working automatically.

The VirtualNetwork service tag allows traffic from any resource within the virtual network, which is too broad and does not restrict traffic to only the frontend tier's load balancer, failing to meet the requirement for a specific source.

Route tables control traffic routing between subnets, not security filtering. NSG rules require source/destination based on IP addresses, service tags, or ASGs, not route table entries.

A service endpoint and firewall rule allow access over the public endpoint using the VM's private IP, but the SQL server name still resolves to a public IP, not a private IP inside the VNet.

A service endpoint does not make the storage account reachable only by private IP; it allows access from the subnet to the storage account via the Azure backbone but still uses the public endpoint of the storage account, and it does not block public access.

A user-defined route (UDR) controls traffic flow to a destination IP, but the storage account's public IP is still publicly accessible. It does not enforce private IP-only access from AppSubnet; traffic would still leave Azure backbone and could be intercepted.

An application security group (ASG) is used to group virtual machines by application roles for network security policy enforcement, not to control network access to a storage account. It cannot make a storage account reachable only by private IP from a subnet.

Changing the deny rule to protocol Any does not affect rule evaluation order; NSG rules are evaluated by priority number, not protocol. The deny rule at priority 100 will still block all RDP traffic before the allow rule at priority 200 is evaluated.

A User Defined Route (UDR) controls traffic routing between subnets or to on-premises, not NSG rule evaluation. Since the VM is in the same subnet, RDP traffic already reaches the VM; the issue is the NSG deny rule blocking it, not routing.

Associating an application security group (ASG) with the VM does not change the priority of existing NSG rules. The deny rule at priority 100 still blocks all RDP traffic, including from the admin subnet, regardless of ASG membership.

Individual private IP addresses change each time the VMs are rebuilt, requiring NSG rule updates. This does not meet the requirement to avoid rewriting rules.

A service endpoint secures Azure service access from a subnet to a specific service (e.g., Azure SQL Database) and does not filter traffic between VMs within a VNet. It cannot be used to allow inbound TCP 1433 from the app tier to backend VMs with dynamic private IPs.

A load balancer inbound NAT rule translates a specific frontend port to a backend VM's private IP and port, but it does not solve the problem of changing private IPs because the NAT rule must be updated each time the backend VM's IP changes, which is the same rewriting issue the question aims to avoid.

A service endpoint does not provide a private IP; it allows access over the public endpoint but restricts it to the VNet. The requirement is to disable public network access entirely, which only a private endpoint can achieve.

A shared access signature (SAS) provides delegated access over the public endpoint, but the question requires public network access to be disabled and only private IP access allowed. SAS does not enforce private-only connectivity.

A VPN gateway connection does not provide private IP access to the storage account; it only extends the VNet to on-premises networks. The storage account would still be publicly accessible unless additional measures are taken, and it does not disable public network access.