AZ-305 Design infrastructure solutions Practice Question
A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?
⚠ Common exam trap
Watch out — candidates often confuse VNet peering's built-in transitive routing (which is disabled by default) with the ability to force traffic through an NVA, mistakenly thinking peering alone or gateway transit can achieve the required inspection without explicit UDRs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA
User-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet
Why it's wrong here
Setting a 0.0.0.0/0 user-defined route on spoke subnets with next hop Internet only affects default outbound traffic, sending it directly to the internet. It does nothing to route spoke-to-spoke traffic through the hub NVA, because inter-spoke traffic targets the peer address space, not the default route. Such a route would actually bypass the hub for any outbound internet traffic and still fail to inspect east-west traffic. Thus this configuration does not enforce centralized inspection for inter-spoke communications.
- ✗
Configure Azure Firewall in the hub with forced tunneling to on-premises
Why it's wrong here
Forced tunneling with Azure Firewall sends internet-bound traffic to on-premises via a VPN/ExpressRoute connection, typically by adding a default route to the hub's gateway. It does not influence routing between spoke virtual networks, which requires explicit routes to the hub NVA for the destination spoke prefix. Azure Firewall can inspect inter-spoke traffic only when UDRs are applied to spokes with the Firewall's private IP as next hop; forced tunneling alone doesn't set that up. This option confuses internet egress control with east-west traffic inspection.
- ✓
Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA
Why this is correct
The correct approach is to create user-defined routes on each spoke subnet with a route for the other spoke's address space and the next hop set to the private IP address of the hub NVA. Because VNet peering is non-transitive, spoke-to-spoke traffic will not automatically flow through the hub; the UDR overrides the system route to force that path. You must also enable IP forwarding on the NVA network interface and ensure the NVA is in a hub subnet so return traffic takes a symmetric path. This gives precise, deterministic control of inter-spoke inspection and is the standard hub-spoke design pattern.
- ✗
Use VNet peering with gateway transit enabled
Why it's wrong here
Enabling gateway transit on the hub peering only allows spoke virtual networks to use the hub's VPN/ExpressRoute gateway for connectivity to on-premises networks. It does not create any routes that send spoke-to-spoke traffic through the hub NVA, nor does it make peering transitive. Without UDRs on the spokes, traffic from one spoke to another is dropped at the hub because the spoke has no route to its peer's address space. Gateway transit is a distinct feature for remote gateway access, not a routing mechanism for east-west inspection.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.