Question
You have an Azure virtual network and an on-premises datacenter that connect by using a Site-to-Site VPN tunnel.
You need to ensure that all traffic from the virtual network to the internet is routed through the datacenter.
How should you complete the PowerShell script to configure forced tunneling? To answer, select the appropriate options in the answer area.
```powershell
$force1 = [Cmdlet 1] -Name "HQ" -ResourceGroupName "ForcedTunneling"
$force2 = Get-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName "ForcedTunneling"
[Cmdlet 2] -GatewayDefaultSite $force1 -VirtualNetworkGateway $force2
```
NOTE: Each correct selection is worth one point.
Explanation
Cmdlet 1 is Get-AzLocalNetworkGateway: the default site for forced tunneling is the local network gateway that represents the on-premises datacenter (HQ), not a NAT gateway, an NVA or the Azure gateway itself. Cmdlet 2 is Set-AzVirtualNetworkGatewayDefaultSite, which assigns that local network gateway as the default site of the route-based VPN gateway so internet-bound traffic is sent over the S2S tunnel. Changing the connection, a peering or a subnet configuration does not set the default site.
