Correct Answer: Configure User-Defined Routes (UDRs) in both spokes pointing the other spoke's address space to the Azure Firewall private IP
VNet peering is non-transitive. To route traffic from one spoke to another through a hub (hub-and-spoke topology), you must create a User-Defined Route (UDR) in each spoke subnet. ...
Correct Answer
Configure User-Defined Routes (UDRs) in both spokes pointing the other spoke's address space to the Azure Firewall private IP
Why This Answer Is Correct
VNet peering is non-transitive. To route traffic from one spoke to another through a hub (hub-and-spoke topology), you must create a User-Defined Route (UDR) in each spoke subnet. The UDR overrides the default system route, forwarding traffic destined for the other spoke's IP range to the Azure Firewall's private IP as the next hop.
This question evaluates your knowledge of Virtual Networks — a core concept tested in Microsoft Certified: Azure Network Engineer Associate (AZ-700). Understanding Virtual Networks is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.