AZ-305 Design infrastructure solutions Practice Question
A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?
⚠ Common exam trap
The trap here is that candidates often forget to enable 'Allow forwarded traffic' on the VNet peering, assuming UDRs alone are sufficient for transitive routing through an NVA, or they confuse 'Allow gateway transit' with NVA forwarding, which is a common misstep in hub-spoke design questions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.
It combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.
Why it's wrong here
A default route would send all traffic to the NVA, including internet traffic, but NAT gateway is not the correct way to route internet traffic through the NVA. Also, east-west traffic routing requires specific UDRs for other spoke address ranges.
- ✗
Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.
Why it's wrong here
This is partially correct but missing the need to enable 'Allow forwarded traffic' on peering. Without that, the NVA cannot forward packets between spokes even with UDRs. However, this is still a plausible but incomplete answer. Option D is more complete.
- ✗
Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.
Why it's wrong here
Gateway transit and 'Use remote gateways' are designed for VPN or ExpressRoute gateway sharing between peered VNets, not for routing traffic through a network virtual appliance (NVA). When you enable gateway transit, the spoke VNets use the hub's virtual network gateway as a remote gateway, but this does not create UDRs or instruct the NVA to forward packets between spokes. Moreover, without 'Allow forwarded traffic' on the peering, the NVA cannot receive or forward traffic from other VNets, so inter-spoke communication fails despite the gateway settings.
- ✓
Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.
Why this is correct
This is the correct design because the hub NVA is placed as a next-hop for inter-spoke traffic via user-defined routes (UDRs) in each spoke route table, and enabling 'Allow forwarded traffic' on the peering lets the NVA accept and route packets between the connected VNets. For outbound internet access, Azure Firewall in the hub provides centralized egress, and a default route (0.0.0.0/0) in the spoke UDRs sends internet-bound traffic to the firewall's private IP. This combination cleanly separates east-west (NVA) and north-south (firewall) traffic while meeting the requirement for a single public IP and controlled routing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.