AZ-104 Practice Question 38: UDR Versus BGP Precedence
Microsoft Azure Administrator Associate (AZ-104) · Test 4 · question 8 of 10
VNet-Hub has an ExpressRoute gateway whose on-premises peer advertises a default route (0.0.0.0/0) by BGP, so traffic from the spokes currently leaves through the customer's on-premises firewall.
On the subnet snet-app, which has the Microsoft.Storage service endpoint enabled, you associate a route table containing a single route: 0.0.0.0/0 with next hop Virtual appliance at 10.0.100.4.
What happens to traffic leaving snet-app after the change?
Show answer and explanation
Answer:
Two rules decide this. First, when several routes share the same address prefix, Azure ranks them: "1. User-defined route, 2. BGP route, 3. System route", so the UDR for 0.0.0.0/0 beats the BGP default route, and traffic that would have gone to the gateway now goes to 10.0.100.4. Second, longest prefix match still applies, and service endpoints add specific routes: "when you enable a service endpoint for a service, Azure creates a route with address prefixes for the service. Traffic to the service doesn't route to the next hop type in a route with the 0.0.0.0/0 address prefix. The address prefixes for the service are longer than 0.0.0.0/0." Microsoft adds that such routes "can't be overridden, even when you use a route table."
Option A inverts the priority list. BGP routes outrank system routes but lose to user-defined routes; that is the whole point of forced tunnelling with a UDR.
Option B describes equal-cost multipath, which Azure route tables don't do for conflicting routes of the same prefix. One route wins, and the other is marked Invalid for that subnet.
Option C is right about the internet traffic and wrong about the storage traffic, the trap in this scenario. It would be correct only if the service endpoint had not been enabled on the subnet.
Reference: Azure virtual network traffic routing