VNet peering for connectivity in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding VNet Peering Connectivity Scope

Which statement correctly describes the connectivity scope of Azure VNet peering?

A VNet peering requires a VPN gateway to enable communication between virtual networks in the same region.

B VNet peering allows direct connectivity between virtual networks in the same or different Azure regions without using gateways.

C VNet peering only works between virtual networks within the same subscription and region.

D VNet peering automatically routes traffic through the internet for cross-region communication.

💡 Hint

Think about how Azure connects virtual networks internally without extra devices.

Azure VNet peering connects virtual networks directly, even across regions, without needing gateways or routing traffic over the internet.

❓ Architecture

intermediate

Designing VNet Peering for Multi-Region Applications

You have two VNets in different Azure regions that must communicate with low latency and high bandwidth. Which design choice best supports this?

A Use VNet peering between the two VNets across regions.

B Set up VPN gateways in each VNet and connect them via VPN tunnels.

C Route traffic through an on-premises network to connect the VNets.

D Use public IP addresses and internet-based communication between VNets.

💡 Hint

Consider Azure's native features for private, fast network connections.

VNet peering across regions provides low latency and high bandwidth by connecting VNets directly within Azure's backbone network.

❓ security

advanced

Security Implications of VNet Peering

After peering two VNets, which security consideration is true?

A Once peered, VNets lose their individual security boundaries and cannot restrict traffic between them.

B Traffic between peered VNets is encrypted by default end-to-end without any additional setup.

C Network Security Groups (NSGs) must be configured separately on each VNet to control traffic between them.

D Peering automatically shares all NSG rules between VNets, so no extra configuration is needed.

💡 Hint

Think about how Azure controls traffic flow between networks.

NSGs apply to each VNet independently; peering does not merge or share NSG rules automatically. You must configure NSGs on each side to control traffic.

❓ service_behavior

advanced

Behavior of Transitive Routing in VNet Peering

You have three VNets: VNet1 peered with VNet2, and VNet2 peered with VNet3. Which statement about routing is true?

A VNet1 cannot communicate with VNet3 unless explicitly peered with VNet3 as well.

B VNet1 can directly communicate with VNet3 through VNet2 using transitive routing.

C Traffic between VNet1 and VNet3 is automatically routed through the internet.

D VNet peering creates a mesh network allowing all VNets to communicate without extra peering.

💡 Hint

Consider how Azure handles routing between peered VNets.

Azure VNet peering does not support transitive routing. Each VNet must be peered directly to communicate.

✅ Best Practice

expert

Best Practice for Managing VNet Peering in Large Environments

In a large Azure environment with many VNets, what is the best practice to simplify and secure VNet peering management?

A Avoid peering and rely on public IP communication between VNets.

B Peer every VNet directly with every other VNet to maximize connectivity.

C Use VPN gateways for all VNet connections to centralize security controls.

D Use hub-and-spoke architecture with a central hub VNet peered to multiple spoke VNets.

💡 Hint

Think about how to reduce complexity and improve security in network design.

Hub-and-spoke reduces the number of peerings needed and centralizes control, improving manageability and security.

Practice

1. What is the main purpose of Azure VNet peering?

easy

A. To connect two virtual networks for direct communication

B. To create a backup of virtual machines

C. To deploy applications faster

D. To monitor network traffic

Solution

1. Step 1: Understand VNet peering concept

   VNet peering allows two virtual networks to communicate directly without going through the internet.

2. Step 2: Identify the main use case

   This direct communication is the primary purpose, enabling resource sharing securely within Azure.

3. Final Answer:

   To connect two virtual networks for direct communication -> Option A

4. Quick Check:

   VNet peering = direct network connection [OK]

Hint: VNet peering links networks directly, not backups or monitoring [OK]

Common Mistakes:

• Confusing peering with VM backup
• Thinking peering speeds up app deployment
• Assuming peering is for traffic monitoring

2. Which of the following is the correct way to create a VNet peering in Azure Portal?

easy

A. Create a new VNet with peering enabled by default

B. Create peering from one VNet only

C. Create peering from both VNets involved

D. Enable peering in the subscription settings

Solution

1. Step 1: Review peering setup requirements

   VNet peering requires configuration from both virtual networks to allow full communication.

2. Step 2: Identify correct procedure

   Creating peering from both VNets ensures bidirectional connectivity and proper routing.

3. Final Answer:

   Create peering from both VNets involved -> Option C

4. Quick Check:

   Peering setup = both sides configured [OK]

Hint: Peering needs setup on both VNets, not just one [OK]

Common Mistakes:

• Configuring peering only on one VNet
• Assuming peering is automatic on new VNets
• Looking for peering in subscription settings

3. Given two VNets, VNetA and VNetB, peered correctly, what happens when a VM in VNetA tries to ping a VM in VNetB?

medium

A. The ping fails because VNets cannot communicate even if peered

B. The ping fails because peering blocks ICMP traffic

C. The ping succeeds only if both VMs are in the same subnet

D. The ping succeeds because peering allows direct communication

Solution

1. Step 1: Understand VNet peering behavior

   Peering connects VNets so resources can communicate directly, including ping (ICMP) traffic if allowed by NSGs.

2. Step 2: Analyze the ping scenario

   If no network security group blocks ICMP, ping from VM in VNetA to VM in VNetB will succeed due to peering.

3. Final Answer:

   The ping succeeds because peering allows direct communication -> Option D

4. Quick Check:

   Peering enables direct VM communication [OK]

Hint: Peering allows direct traffic unless blocked by security rules [OK]

Common Mistakes:

• Assuming peering blocks ping by default
• Thinking VMs must be in same subnet to communicate
• Believing peering does not enable VNet communication

4. You created VNet peering from VNetA to VNetB but forgot to create peering from VNetB to VNetA. What is the result?

medium

A. Full bidirectional communication between VNets

B. Unidirectional communication from VNetA to VNetB only

C. No communication between VNets

D. Peering automatically completes from both sides

Solution

1. Step 1: Understand peering directionality

   Peering must be created on both VNets for full bidirectional communication.

2. Step 2: Analyze partial peering effect

   With peering only from VNetA to VNetB, traffic flows from A to B but not from B to A.

3. Final Answer:

   Unidirectional communication from VNetA to VNetB only -> Option B

4. Quick Check:

   One-sided peering = one-way traffic [OK]

Hint: Peering one side = one-way connection only [OK]

Common Mistakes:

• Assuming peering is automatic both ways
• Expecting no communication at all
• Thinking peering creates full connection from one side

5. You have two VNets in different Azure regions and want to enable secure, low-latency communication between them. Which VNet peering type should you use?

hard

A. Global VNet peering

B. Local VNet peering

C. VPN Gateway peering

D. ExpressRoute peering

Solution

1. Step 1: Identify peering types and their use cases

   Local VNet peering works within the same region; global VNet peering connects VNets across regions.

2. Step 2: Choose peering for cross-region communication

   Global VNet peering enables secure, low-latency communication between VNets in different Azure regions.

3. Final Answer:

   Global VNet peering -> Option A

4. Quick Check:

   Cross-region VNet peering = global peering [OK]

Hint: Use global peering for cross-region VNet connection [OK]

Common Mistakes:

• Choosing local peering for different regions
• Confusing VPN Gateway with peering
• Selecting ExpressRoute which is for on-premises