hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: A large enterprise is designing a secure…
A large enterprise is designing a secure infrastructure for a multi-region application deployment. They have a hub-spoke topology in two Azure regions (East US and West US) with VNet peering between the hubs. Each region has a shared services spoke containing Azure AD Domain Services (AAD DS) and management jump boxes. Application spokes in each region host VMs that need to authenticate to the local AAD DS. The company mandates that all traffic between regions must traverse a network virtual appliance (NVA) for inspection, except for Azure management traffic. They also require that all outbound internet traffic from application VMs goes through a single Azure Firewall in the East US hub. They have deployed ExpressRoute to on-premises. Currently, application VMs in West US cannot authenticate to the local AAD DS. What is the most likely cause?
⚠ Common exam trap
Candidates often assume the Azure Firewall or VNet peering is misconfigured, but the real issue is a routing override that forces local traffic through a non-local path, a classic 'asymmetric routing' or 'forced tunneling' pitfall in multi-region hub-spoke topologies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA, causing traffic to AAD DS to be sent across regions.
The most likely cause is that the route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA. This forces all outbound traffic, including traffic destined for the local AAD DS (which resides in the same region's shared services spoke), to be routed through the NVA and potentially across regions via the hub peering, rather than staying within the local VNet. Since AAD DS requires low-latency, direct connectivity within the same region, this misrouting prevents authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure Firewall in East US is not configured to allow traffic from West US to AAD DS.
Why it's wrong here
Azure Firewall in East US is not the cause of the authentication failure because Azure AD Domain Services (AAD DS) is accessed privately within the East US virtual network, and authentication traffic never traverses the Azure Firewall as a transit point. A UDR in the West US spoke would need to explicitly send traffic to the firewall's public IP or internal load balancer for the firewall to even see it, and Azure Firewall is not an intermediary for AAD DS authentication. The firewall's application or network rules would only matter for traffic that is actually forwarded to it, but the root issue is the routing path taken by the West US spoke, not a missing allow rule.
- ✗
The VNet peering between East and West US hubs is not properly configured with 'Allow forwarded traffic' enabled.
Why it's wrong here
The 'Allow forwarded traffic' setting on VNet peering controls whether traffic from a peered VNet can be forwarded through a network virtual appliance (NVA) in the hub to another VNet or on-premises. For cross-region traffic, disabling this setting would prevent the NVA from forwarding packets between the West US spoke and the East US hub, but AAD DS traffic is destined to the East US region, and a more specific route could handle it directly without requiring forwarding. The actual misconfiguration is that the West US spoke's default route sends all traffic to the local NVA, which may then discard or send it out of region; even if 'Allow forwarded traffic' were enabled, it would not cause traffic to be directed to AAD DS across regions, so this is not the root cause.
- ✗
The ExpressRoute circuit is down, causing traffic to be routed over the internet.
Why it's wrong here
ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, but AAD DS authentication in this scenario involves Azure VNet-to-VNet traffic between the West US application spoke and the East US AAD DS deployment, not on-premises traffic. A failed ExpressRoute circuit would only affect connectivity to on-premises resources, and since the workload is already in Azure, authentication requests would be routed over the Azure backbone regardless of ExpressRoute status. Therefore, an ExpressRoute outage is irrelevant to the inability to authenticate to AAD DS from the West US application; the issue lies solely in the incorrect routing configuration within the Azure virtual network.
- ✓
The route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA, causing traffic to AAD DS to be sent across regions.
Why this is correct
The route table on the West US application spoke's subnet contains a default route (0.0.0.0/0) that specifies the NVA as the next hop, overriding Azure's system default route. When the application resolves the AAD DS domain name, it receives a private IP address in the East US VNet, and because the default route matches all destinations, the traffic is sent to the NVA instead of being routed directly via the established VNet peering or hub. If the NVA is not configured to forward traffic to the East US region, or if it sends it over the internet or a different path, the traffic never reaches AAD DS while return traffic may arrive via a different route, causing asymmetric routing and session failures. The correct fix is to add a more specific route for the AAD DS IP range pointing to the East US hub or directly to the peered VNet, ensuring traffic stays within the Azure backbone and avoids the unintended NVA detour.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.