A retired partner prefix must not leave the compost-lab subnet at all, even toward the hub firewall. Which user-defined route next hop should the security engineer configure for that prefix?
Select an answer to reveal the explanation.
Short Explanation
That old partner prefix shouldn’t hitch a ride anywhere—not even to the firewall. UDR it with next hop None and let the packets fall into the bit bucket.
Full Explanation
A user-defined route with next hop None blackholes matching traffic: packets are dropped rather than forwarded to a firewall, Internet, or gateway. For a retired partner prefix that must not leave the compost-lab subnet at all—even toward the hub firewall—configure a UDR for that prefix with next hop None.
Virtual appliance to the firewall fails the requirement because traffic is still forwarded for inspection. Next hop Internet sends the prefix out directly. Next hop VNet gateway forwards toward hybrid connectivity rather than dropping locally.
Exam caveat: next hop None is the deliberate sinkhole pattern for prefixes that must die on the subnet. Operational check: add the UDR for the retired partner prefix with None, test that packets do not leave, confirm hub firewall never sees that prefix from the lab, and document why the partner range remains sinkholed. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.