You have an Azure subscription that contains an Azure Virtual Desktop deployment, a standard Azure Firewall instance named FW1, and the virtual networks shown in the following table. You need to…

Question

Exhibit

Options

• AUpgrade FW1 to the Premium SKU.
• BDeploy Azure NAT Gateway to VNet1.
• CFor FW1, enable DNS Proxy.
• DDeploy Azure Route Server to VNet2.

• A
  6% (4)
• B
  3% (2)
• C
  14% (9)
• D
  76% (48)

Explanation

To route all outbound traffic from VNet2 through FW1 (located in another VNet) while minimizing impact on the existing AVD deployment, the first step is to deploy Azure Route Server to VNet2. Azure Route Server enables dynamic route exchange between Azure Firewall (or NVAs) and the VNet using BGP, automatically propagating FW1's routes into VNet2 without requiring manual User Defined Routes (UDRs) on every subnet - which is less disruptive to existing AVD infrastructure. The other options are incorrect for this first step: (A) Upgrading to Premium SKU is unnecessary just to route traffic; (B) NAT Gateway handles outbound SNAT but doesn't redirect traffic through a firewall; (C) DNS Proxy on FW1 aids DNS resolution, not traffic routing. Route Server is the correct first action to enable dynamic, scalable routing through FW1.

No community discussion yet for this question.