Exam AZ-500 topic 3 question 25 discussion

To prevent communication to Vnet1 from Vnet2, the option "Traffic to remote virtual network" must be set to Block. A small popup will be shown saying the following: "Resources in Vnet2 cannot communicate to resources in the Vnet1"

Tested the following setting and I can ping from VNET1 to VNET2, but not from VNET2 to VNET1. **VNET1 - peering setting** Traffic to remote virtual network: Allow (default) Traffic forwarded from remote virtual network: Block traffic that originates from outside this virtual network Virtual network gateway or Route Server: None (default) **VNET2 - peering setting** Traffic to remote virtual network: Block all traffic to the remote virtual network Traffic forwarded from remote virtual network: Block traffic that originates from outside this virtual network Virtual network gateway or Route Server: None (default)

Refer to Microsoft support reply: In general when Vnet are peered with each other, controlling access between them can be done by using Azure Network Security Groups which filter network traffic to and from Azure resources in an Azure virtual network. https://learn.microsoft.com/en-us/answers/questions/569509/vnet-one-way-traffic-route-help

But. This is a lab. On exams actually there is not labs, correct?

Question doesn't say that not to communicate from VNET2 to VNET1 then why should block that remote traffic to VNET1 from VNET2 I think question phrase is confusing

The word "communicate" assumes traffic in both directions.

Please in the simulation questions on the exam day, will the options for the answers be made available

Tested this. Vnet1 - Traffic to remote virtual network: Allow Traffic forwarded from remote virtual network: Block Vnet2 - Traffic to remote virtual network: Block Traffic forwarded from remote virtual network: Block Vnet2 NSG - Inbound Security Rule - Port: Any, Protocol: Any, Source: {insert subnets}, Destination: VirtualNetwork, Action: Allow.

in Exam 31 Dec 2021.

# Exam Question 12/10/2021

This is working as required in the question. Ping is not a right way to test it as ICMP requires allow on both sender and receiver ends. Good way to test it is by doing RDP from VNET1 to VNET2 (this should be allowed) and RDP from VNET2 to VNET1 (this should not be allowed) **VNET1 - peering setting** Traffic to remote virtual network: Allow (default) Traffic forwarded from remote virtual network: Block traffic that originates from outside this virtual network Virtual network gateway or Route Server: None (default) **VNET2 - peering setting** Traffic to remote virtual network: Block all traffic to the remote virtual network Traffic forwarded from remote virtual network: Block traffic that originates from outside this virtual network Virtual network gateway or Route Server: None (default)

The way I got this working is doing the below 1. Create a peering between the two VNETS allowing all traffic both sides. 2. Create an NSG and assign it to VNET1 on the subnet where the VMs exist. In my case this was Subnet1. 3. Create an inbound rule on the NSG denying all traffic from the address space on VNET2. 4. Once done you will be able to communicate from VNET1 to VNET2 but not VNET2 to VNET1.

why in step 6 it is said to not activate bi directional communication?

In the step 7. For the option Allow virtual network access from remote network to VNET1, click the slider button to Disabled........This means that the VNET1 won't be included in the VirtualNetwork TAG used in the NSG default rules on each resource, so ok, traffic from VNET1 to VNET2 will be allowed on VNET1 side, but on VNET2 side it won't be allowed by default....so, it won't allow communication from VNET1 to VNET2 at all; you'll need an especific NSG rule in the resources on VNET2 to allow the traffic you need as the VNET1 is not included in the Virtual Networl TAG, just tested it.

The provided answer is correct as VMs in Vnet 1 can communicate with VMs in Vnet 2 and not bi-directional communication

anyone knows the updated answer for this using the current interface ?