AZ-700 VPN Gateway 2 — Questions and Answers
Question 1: Which protocol must be used for Point-to-Site VPN when Azure AD authentication is selected?
- SSTP
- IKEv2
- OpenVPN (Correct answer)
- L2TP/IPsec
Correct answer: OpenVPN
Azure AD authentication for P2S VPN is only supported with the OpenVPN protocol.
Question 2: What is the function of BGP in Azure VPN Gateway?
- Encrypts VPN tunnel traffic
- Dynamically exchanges routes between Azure and on-premises networks (Correct answer)
- Provides DDoS protection for the gateway
- Balances traffic across multiple tunnels
Correct answer: Dynamically exchanges routes between Azure and on-premises networks
BGP enables dynamic route exchange between Azure VPN Gateway and on-premises BGP-capable devices, removing the need for static route management.
Question 3: In an active-active VPN Gateway configuration, what is created to ensure high availability?
- Two separate VPN gateways in different regions
- Two gateway instances each with their own public IP and BGP peer (Correct answer)
- One active and one standby instance sharing a single IP
- Two Local Network Gateways
Correct answer: Two gateway instances each with their own public IP and BGP peer
Active-active mode deploys two gateway instances, each with its own public IP, establishing dual tunnels for redundancy.
Question 4: Which IKE version does Azure VPN Gateway use by default for Route-based VPN connections?
- IKEv1
- IKEv2 (Correct answer)
- IKEv3
- Both IKEv1 and IKEv2 equally
Correct answer: IKEv2
Azure VPN Gateway defaults to IKEv2 for route-based VPN connections, though IKEv1 is supported for policy-based connections.
Question 5: What Azure resource must be provisioned in the GatewaySubnet before deploying a VPN Gateway?
- Nothing — the gateway deploys directly into GatewaySubnet
- A public IP address resource (Correct answer)
- A Network Security Group
- A route table with default routes
Correct answer: A public IP address resource
A Public IP address resource must be created and associated with the VPN Gateway before deployment.
Question 6: What is the recommended GatewaySubnet CIDR size for a production VPN Gateway deployment to support future scaling?
- /32
- /30
- /27 or larger (Correct answer)
- /24
Correct answer: /27 or larger
Microsoft recommends using /27 or larger for GatewaySubnet to accommodate additional gateway resources and future ExpressRoute coexistence.
AZ-700 VPN Gateway 2
Which protocol must be used for Point-to-Site VPN when Azure AD authentication is selected?