TPT Limited has an SAP production landscape on-premises and an SAP development landscape on Microsoft Azure. TPT Limited wants to deploy a network virtual appliance which will act as a firewall…

Question

Options

• AYes
• BNo

• A
  25% (6)
• B
  75% (18)

Explanation

B is correct because route filters for Microsoft peering are designed to control access to Microsoft public cloud services (such as Microsoft 365 and Azure public endpoints) - they are not the mechanism for routing traffic between an Azure VNet subnet and an on-premises network. To achieve the NVA-as-firewall goal, TPT Limited would need ExpressRoute Private Peering combined with User Defined Routes (UDRs) to force traffic through the NVA; Microsoft peering simply does not govern that traffic path.

Why A is wrong: The scenario conflates two distinct ExpressRoute peering types. Microsoft peering and its route filters operate on a completely separate plane from the private connectivity between Azure VNets and on-premises infrastructure, so deploying the NVA under this configuration will not intercept or filter the intended traffic.

Memory tip: Use the phrase "Microsoft Peering = Microsoft's services, Private Peering = your private stuff." Route filters on Microsoft peering only let you pick which Microsoft cloud services (e.g., Exchange Online, SharePoint) you receive routes for - they have no authority over traffic flowing into your own Azure VNet subnets.

No community discussion yet for this question.