Question

Your company runs several workloads in an Azure VNet subnet named AppSubnet. For regulatory compliance, all internet-bound traffic from these VMs must be inspected by an on-premises firewall before it can leave the corporate network. You have already deployed a site-to-site VPN gateway connecting the VNet to the on-premises datacenter. Which configuration correctly implements forced tunneling for AppSubnet?

Accepted Answer

Create a user-defined route with address prefix 0.0.0.0/0 and next hop type Virtual network gateway, and associate the route table with AppSubnet.

Answer

Create a user-defined route with address prefix 0.0.0.0/0 and next hop type Internet, and associate the route table with AppSubnet.

Answer

Enable a NAT gateway on AppSubnet so that all outbound traffic is routed through the on-premises firewall.

Answer

Add a service endpoint for Microsoft.Network on AppSubnet and configure the VPN gateway as the default gateway.