nerdexam
Microsoft

AZ-801 · Question #133

You have an Azure subscription that contains a user named User1 and the resources shown in the following table. Name Description Vnet1 Virtual network AppSvr1 Virtual machine that is connected to…

The correct answer is A. On Computer1, download and reinstall the VPN client. After a new VNet peering is added post-deployment, P2S VPN clients must be re-downloaded and reinstalled to receive updated route information that includes the newly peered VNet address space.

Monitor and troubleshoot Windows Server environments

Question

You have an Azure subscription that contains a user named User1 and the resources shown in the following table. Name Description Vnet1 Virtual network AppSvr1 Virtual machine that is connected to Vnet1 and runs a legacy app GW1 Virtual network gateway on VNet1 User1 has a computer named Computer1 that runs Windows 11. User1 works from home and establishes a Point-to-Site (P2S) connection to GW1 to access AppSvr1. You deploy the resources shown in the following table. Name Description Vnet2 Virtual network that is peered with VNet1 AppSvr2 Virtual machine that is connected to VNet2 User1 cannot access AppSvr2. You need to ensure that User1 can access AppSvr2. What should you do?

Options

  • AOn Computer1, download and reinstall the VPN client.
  • BCreate a route table and associate the table with GatewaySubnet on VNet1.
  • COn Computer1, modify the Windows Defender Firewall settings.
  • DAdd a service endpoint to VNet2.

How the community answered

(22 responses)
  • A
    73% (16)
  • B
    5% (1)
  • C
    5% (1)
  • D
    18% (4)

Why each option

After a new VNet peering is added post-deployment, P2S VPN clients must be re-downloaded and reinstalled to receive updated route information that includes the newly peered VNet address space.

AOn Computer1, download and reinstall the VPN client.Correct

Point-to-Site VPN client configuration packages embed routing information at the time of download; when VNet2 was peered with VNet1 after the original client package was generated, the client has no route to VNet2's address space, so downloading and reinstalling the VPN client from GW1 provides an updated profile that includes the peered VNet prefix.

BCreate a route table and associate the table with GatewaySubnet on VNet1.

Adding a route table to GatewaySubnet affects routing between Azure resources within the virtual network fabric, but the issue is that the client-side VPN profile is missing routes to VNet2, not that Azure-side routing is broken.

COn Computer1, modify the Windows Defender Firewall settings.

Windows Defender Firewall settings on Computer1 do not control which VNet address prefixes are advertised or reachable through the VPN tunnel; the root cause is missing routes in the downloaded VPN client profile.

DAdd a service endpoint to VNet2.

Service endpoints restrict traffic to specific Azure PaaS services within a VNet boundary and are unrelated to extending P2S VPN reachability to a peered virtual network.

Concept tested: P2S VPN client update required after adding VNet peering

Source: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

Topics

#Azure Point-to-Site VPN#VPN Client Configuration#Azure VNet Peering#Network Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-801 Practice