VNet-to-VNet connectivity in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a virtual network with the correct address space.

Azure

az network vnet create --name MyVNet --resource-group MyResourceGroup --address-prefix [1]

Drag options to blanks, or click blank then click option'

A192.168.1.0/24

B10.0.0.0/16

C172.16.0.0/12

D255.255.255.0

Attempts:

3 left

💡 Hint

Common Mistakes

Using a subnet mask instead of CIDR notation.

Using a public IP range.

The address prefix for a virtual network must be a valid CIDR block like 10.0.0.0/16.

2fill in blank

medium

Complete the code to create a virtual network peering from VNet1 to VNet2.

Azure

az network vnet peering create --name VNet1ToVNet2 --resource-group MyResourceGroup --vnet-name VNet1 --remote-vnet-id [1] --allow-vnet-access

Drag options to blanks, or click blank then click option'

AMyResourceGroup

BVNet3

C/subscriptions/{subscription-id}/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/VNet2

DVNet1

Attempts:

3 left

💡 Hint

Common Mistakes

Using the VNet name instead of the full resource ID.

Using the resource group name instead of VNet resource ID.

The remote virtual network ID must be the full resource ID of the VNet you want to peer with, here VNet2.

3fill in blank

hard

Fix the error in the peering command by completing the missing parameter for allowing forwarded traffic.

Azure

az network vnet peering update --name VNet1ToVNet2 --resource-group MyResourceGroup --vnet-name VNet1 --set allowForwardedTraffic=[1]

Drag options to blanks, or click blank then click option'

Afalse

Benabled

Cyes

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using string values like 'yes' or 'enabled' instead of true.

Using false disables forwarded traffic.

The parameter allowForwardedTraffic expects a boolean value true or false. Use true to allow forwarded traffic.

4fill in blank

hard

Fill both blanks to create a peering that allows gateway transit and uses remote gateways.

Azure

az network vnet peering create --name VNet2ToVNet1 --resource-group MyResourceGroup --vnet-name VNet2 --remote-vnet-id /subscriptions/{subscription-id}/resourceGroups/MyResourceGroup/providers/Microsoft.Network/virtualNetworks/VNet1 --allow-vnet-access --allow-gateway-transit=[1] --use-remote-gateways=[2]

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

Cyes

Dno

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up true and false for these parameters.

Using 'yes' or 'no' instead of boolean values.

To allow gateway transit and use remote gateways, set allow-gateway-transit to true and use-remote-gateways to true.

5fill in blank

hard

Fill all three blanks to create a subnet with the correct name, address prefix, and network security group association.

Azure

az network vnet subnet create --resource-group MyResourceGroup --vnet-name MyVNet --name [1] --address-prefix [2] --network-security-group [3]

Drag options to blanks, or click blank then click option'

AGatewaySubnet

B10.0.1.0/24

CMyNSG

DSubnet1

Attempts:

3 left

💡 Hint

Common Mistakes

Using special subnet names like GatewaySubnet which cannot have NSG.

Using an invalid address prefix.

Not associating the correct NSG.

The subnet name is 'Subnet1'. The address prefix must be a valid CIDR block like 10.0.1.0/24. The network security group must be the name of an existing NSG, here 'MyNSG'.

Practice

1. What is the main purpose of VNet-to-VNet peering in Azure?

easy

A. To create a backup of a virtual network

B. To securely connect two virtual networks for resource sharing

C. To connect a virtual network to the internet

D. To increase the size of a single virtual network

Solution

1. Step 1: Understand VNet-to-VNet peering concept

   VNet-to-VNet peering connects two virtual networks securely to allow communication.

2. Step 2: Identify the purpose of peering

   It enables resource sharing between VNets without exposing them to the internet.

3. Final Answer:

   To securely connect two virtual networks for resource sharing -> Option B

4. Quick Check:

   VNet peering = secure VNet connection [OK]

Hint: Peering connects VNets securely, not to internet or backup [OK]

Common Mistakes:

• Confusing peering with internet connectivity
• Thinking peering increases VNet size
• Assuming peering creates backups

2. Which of the following is the correct way to establish VNet peering between two VNets in Azure?

easy

A. Create peering from VNet1 to VNet2 only

B. Create peering from VNet2 to VNet1 only

C. Create peering from both VNet1 to VNet2 and VNet2 to VNet1

D. No peering needed, VNets connect automatically

Solution

1. Step 1: Review peering setup requirements

   Peering must be created from both VNets to allow two-way communication.

2. Step 2: Identify correct peering configuration

   Only creating peering one way does not enable full connectivity.

3. Final Answer:

   Create peering from both VNet1 to VNet2 and VNet2 to VNet1 -> Option C

4. Quick Check:

   Two-way peering needed = Create peering from both VNet1 to VNet2 and VNet2 to VNet1 [OK]

Hint: Peering must be two-way for full VNet connectivity [OK]

Common Mistakes:

• Setting peering only one way
• Assuming VNets connect automatically
• Confusing peering with VPN gateways

3. Given two VNets, VNetA and VNetB, with peering configured correctly, what happens if you try to access a VM in VNetB from VNetA?

medium

A. The VM in VNetB is accessible as if on the same network

B. The VM in VNetB is blocked by default firewall rules

C. The VM in VNetB is unreachable without a VPN gateway

D. The VM in VNetB is accessible only via public IP

Solution

1. Step 1: Understand effect of correct VNet peering

   Peering allows VNets to communicate privately as if on the same network.

2. Step 2: Analyze access to VM in peered VNet

   VMs can be accessed using private IPs without VPN or public IP.

3. Final Answer:

   The VM in VNetB is accessible as if on the same network -> Option A

4. Quick Check:

   Peering enables private access = The VM in VNetB is accessible as if on the same network [OK]

Hint: Peered VNets act like one network for VM access [OK]

Common Mistakes:

• Thinking VPN gateway is always needed
• Assuming public IP is required
• Confusing firewall rules with peering

4. You set up VNet peering from VNet1 to VNet2 but cannot access resources in VNet2 from VNet1. What is the most likely cause?

medium

A. Peering was not created from VNet2 to VNet1

B. VNet1 and VNet2 have overlapping IP address ranges

C. Network Security Groups block traffic between VNets

D. All of the above

Solution

1. Step 1: Check peering configuration

   Peering must be created both ways; missing one side blocks communication.

2. Step 2: Verify IP address ranges and security rules

   Overlapping IPs cause routing conflicts; NSGs may block traffic.

3. Step 3: Combine all issues

   Any of these can cause access failure; all are common mistakes.

4. Final Answer:

   All of the above -> Option D

5. Quick Check:

   Multiple causes block access = All of the above [OK]

Hint: Check peering, IP ranges, and NSGs when access fails [OK]

Common Mistakes:

• Ignoring one-way peering setup
• Overlapping IP ranges unnoticed
• Not checking firewall or NSG rules

5. You have two VNets in different Azure regions that need to communicate privately. Which approach is best to enable this with minimal latency and no internet exposure?

hard

A. Use VNet-to-VNet peering with global peering enabled

B. Set up a VPN gateway connection between the VNets

C. Connect VNets via public IP addresses

D. Use ExpressRoute with public peering

Solution

1. Step 1: Identify connectivity options for cross-region VNets

   Global VNet peering allows private, low-latency connection between VNets in different regions.

2. Step 2: Compare alternatives

   VPN gateways add latency and complexity; public IPs expose traffic; ExpressRoute public peering is not private.

3. Step 3: Choose best practice

   Global VNet peering is recommended for private, fast cross-region VNet communication.

4. Final Answer:

   Use VNet-to-VNet peering with global peering enabled -> Option A

5. Quick Check:

   Global peering = private, low latency cross-region [OK]

Hint: Global peering connects regions privately with low latency [OK]

Common Mistakes:

• Using VPN gateways unnecessarily
• Exposing traffic via public IPs
• Confusing ExpressRoute public peering with private