AZ-700 AZ-700 ExpressRoute and VPN Gateway 2 — Questions and Answers
Question 1: Which VPN Gateway configuration is required to enable active-active mode?
- Two VPN gateways in different VNets
- A single gateway with two public IP addresses and BGP enabled (Correct answer)
- A zone-redundant SKU with a single public IP
- Active-active requires an ExpressRoute co-existence setup
Correct answer: A single gateway with two public IP addresses and BGP enabled
Active-active VPN Gateway mode requires the gateway to be configured with two public IP addresses and BGP must be enabled for both tunnel endpoints.
Question 2: What is the default BGP Autonomous System Number (ASN) for Azure VPN Gateway?
- 65000
- 64512
- 65515 (Correct answer)
- 65535
Correct answer: 65515
Azure VPN Gateway uses ASN 65515 by default for BGP peering, though you can configure a custom private ASN during gateway creation.
Question 3: Which VPN Gateway SKU naming convention indicates availability zone redundancy?
- The SKU name ends in 'ZR'
- The SKU name ends in 'AZ' (e.g., VpnGw1AZ) (Correct answer)
- The SKU name starts with 'Zone-'
- The SKU name includes 'HA'
Correct answer: The SKU name ends in 'AZ' (e.g., VpnGw1AZ)
Zone-redundant VPN Gateway SKUs are identified by the 'AZ' suffix (e.g., VpnGw1AZ, VpnGw2AZ), deploying gateway instances across availability zones for higher resilience.
Question 4: How many VNets can a Standard-tier ExpressRoute circuit be linked to by default?
- 4
- 10 (Correct answer)
- 20
- Unlimited
Correct answer: 10
A Standard ExpressRoute circuit can be linked to up to 10 Azure virtual networks; upgrading to the Premium add-on increases this limit significantly.
Question 5: What IKE versions does Azure VPN Gateway support for site-to-site connections?
- IKEv2 only
- IKEv1 only
- Both IKEv1 and IKEv2 (Correct answer)
- IKEv3 (Azure-proprietary)
Correct answer: Both IKEv1 and IKEv2
Azure VPN Gateway supports both IKEv1 and IKEv2 for site-to-site IPsec/IKE VPN tunnels, providing compatibility with a wide range of on-premises VPN devices.
Question 6: Which point-to-site VPN authentication methods does Azure VPN Gateway support?
- Only certificate-based authentication
- Certificate, Azure Active Directory, and RADIUS (Correct answer)
- RADIUS and LDAP only
- Only Azure Active Directory authentication
Correct answer: Certificate, Azure Active Directory, and RADIUS
Azure VPN Gateway point-to-site supports three authentication methods: native Azure certificate authentication, Azure Active Directory (for OpenVPN), and RADIUS for custom authentication servers.
AZ-700 AZ-700 ExpressRoute and VPN Gateway 2
Which VPN Gateway configuration is required to enable active-active mode?