AZ-800 - Microsoft Azure Networking Solutions Azure Virtual WAN Implementation Questions and Answers — Questions and Answers
Question 1: An organization is deploying a global network to connect hundreds of branch offices and multiple Azure VNets across several regions. They require a managed service that simplifies routing, provides any-to-any transitive connectivity, and minimizes the operational overhead of managing complex peering relationships and on-premises VPN device configurations. Which Azure service is the most appropriate solution?
- A series of interconnected Azure VPN Gateways
- Global VNet Peering for all VNets
- Azure Virtual WAN (Correct answer)
- Azure ExpressRoute with Global Reach
Correct answer: Azure Virtual WAN
Azure Virtual WAN is a managed networking service that brings networking, security, and routing functionalities together into a single operational interface. It is designed for large-scale, global transit network architectures, providing built-in, fully meshed, any-to-any connectivity for branches, VNets, and remote users without the complexity of managing individual peerings or tunnels.
Question 2: Within an Azure Virtual WAN hub, which component is the core of the network in the region, managing all routing decisions and enabling transitive connectivity between connected VNets, Site-to-Site VPN branches, and ExpressRoute circuits?
- The Virtual Hub Router (Correct answer)
- The Site-to-Site VPN Gateway
- The ExpressRoute Gateway
- The VNet Connection
Correct answer: The Virtual Hub Router
The Virtual Hub Router is the central component within a Virtual WAN hub that manages all routing, including transit routing, between all connected gateways and virtual networks. The gateways (VPN, ExpressRoute) handle the specific connection types, but the router makes the decisions on how to forward traffic between them.
Question 3: A company is planning to deploy Azure Virtual WAN to connect its on-premises data centers and Azure VNets. A key requirement is to integrate their existing ExpressRoute circuits. Which of the following is a primary requirement for this implementation?
- Deploying a Basic Virtual WAN
- Using Azure Firewall Premium in the hub
- Configuring a separate VPN Gateway for failover
- Deploying a Standard Virtual WAN (Correct answer)
Correct answer: Deploying a Standard Virtual WAN
Azure Virtual WAN is available in two types: Basic and Standard. A key differentiator is that the Basic SKU only supports Site-to-Site VPN connectivity. The Standard SKU is required for more advanced capabilities, including connecting ExpressRoute circuits, User VPN (Point-to-Site), and VNet-to-VNet transitive connectivity.
Question 4: A company uses Azure Virtual WAN to connect its branch offices and Azure VNets. The security team requires that all traffic between the branch offices and the VNets, as well as all traffic destined for the internet from these spokes, must be inspected. What is the most integrated and automated method to achieve this within the Virtual WAN architecture?
- Deploy a Network Virtual Appliance (NVA) in a separate VNet and configure User Defined Routes (UDRs).
- Convert the virtual hub into a Secured Virtual Hub by deploying Azure Firewall. (Correct answer)
- Apply Network Security Groups (NSGs) to the subnets in each spoke VNet.
- Establish a direct VNet peering between all spoke VNets.
Correct answer: Convert the virtual hub into a Secured Virtual Hub by deploying Azure Firewall.
Converting a virtual hub into a Secured Virtual Hub by associating it with an Azure Firewall policy is the native, recommended solution. This allows Azure Firewall Manager to automate the routing of all private and internet-bound traffic from connected spokes through the firewall for inspection, without requiring manual UDR configuration.
Question 5: An administrator is connecting a new spoke Virtual Network (VNet) to an existing Azure Virtual WAN hub. What is the specific name of the resource they must create in the Virtual WAN to establish this link?
- VNet Peering
- A Service Endpoint
- A Virtual Network Connection (Correct answer)
- A Private Link
Correct answer: A Virtual Network Connection
To link a spoke VNet to a Virtual WAN hub, you create a 'Virtual Network Connection'. This is distinct from 'VNet Peering', which is used to connect two standard VNets together. The Virtual Network Connection establishes the spoke's relationship with the managed hub.
Question 6: Your company uses a Standard Azure Virtual WAN with a hub in East US and another hub in West Europe. A virtual machine in a spoke VNet connected to the East US hub needs to communicate with a database server in a spoke VNet connected to the West Europe hub. How is this cross-region communication enabled by default?
- Through the inherent hub-to-hub connectivity of a Standard Virtual WAN (Correct answer)
- By configuring Global VNet Peering between the two spoke VNets
- By deploying an ExpressRoute circuit with Global Reach
- By creating a Site-to-Site VPN tunnel between the two hubs
Correct answer: Through the inherent hub-to-hub connectivity of a Standard Virtual WAN
A key feature of the Standard Virtual WAN SKU is that all virtual hubs within the WAN are automatically connected in a full mesh. This creates a global transit network over the Microsoft backbone, enabling seamless inter-hub and cross-region communication between any connected spokes without additional configuration.
AZ-800 - Microsoft Azure Networking Solutions Azure Virtual WAN Implementation Questions and Answers
An organization is deploying a global network to connect hundreds of branch offices and multiple Azure VNets across several regions.
They require a managed service that simplifies routing, provides any-to-any transitive connectivity, and minimizes the operational overhead of managing complex peering relationships and on-premises VPN device configurations.
Which Azure service is the most appropriate solution?