AZ-104 Practice Question 69: Peering Gateway Transit

Microsoft Azure Administrator Associate (AZ-104) · Test 7 · question 9 of 10

Virtual Networkinghard

A hub VNet has a VPN gateway with a site-to-site connection to the on-premises network. A spoke VNet is peered with the hub, and VMs in the spoke can reach VMs in the hub but not the on-premises network. The company wants the spoke to use the hub's gateway and does not want to pay for a second gateway.

Which configuration change should the administrator make?

Show answer and explanation

Answer:

B. Enable Allow gateway transit on the hub peering, and Use remote gateways on the spoke peering

Gateway transit lets a peered VNet use the VPN or ExpressRoute gateway of the VNet it is peered with. The hub's side of the peering must have Allow gateway transit turned on, and the spoke's side must have Use remote gateways turned on. The spoke then routes on-premises traffic through the hub gateway, and no gateway is needed in the spoke. The spoke must not have its own gateway when it uses the remote one.

Option A does not add a route through the gateway. Allow forwarded traffic permits traffic that did not originate in the peered VNet to be accepted, but the spoke still has no path to the on-premises network without gateway transit.

Option C works but breaks the constraint. A second gateway costs money, and it is exactly what gateway transit avoids. It would also conflict with Use remote gateways on the same VNet.

Option D is about how routes are exchanged with the on-premises device. The missing piece is the spoke's ability to use the hub's gateway, and BGP does not provide it.

Reference: Virtual network peering

Practice Test 7 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.

AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.

Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.

Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.

Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.