AZ-800 - Microsoft Azure Networking Solutions Hybrid VPN Gateway Design Questions and Answers — Questions and Answers
Question 1: A company is designing a highly available hybrid network connection to Azure. They require automatic failover for their Site-to-Site VPN connection. Which Azure VPN Gateway configuration and routing protocol should be used to meet this requirement?
- Active-standby gateway with static routing
- Active-active gateway with BGP (Correct answer)
- Policy-based VPN gateway with static routing
- Active-standby gateway with BGP
Correct answer: Active-active gateway with BGP
An active-active VPN gateway configuration provides high availability by having two active gateway instances. When combined with Border Gateway Protocol (BGP), it enables automatic and rapid failover. BGP is a dynamic routing protocol that automatically exchanges routing information, allowing traffic to be rerouted to a healthy tunnel if one fails.
Question 2: You are configuring a hybrid VPN solution and need to ensure that routing updates from your on-premises network are automatically propagated to the Azure Virtual Network. Which of the following is a primary benefit of using BGP with an Azure VPN Gateway?
- It encrypts traffic using a stronger algorithm than static routing.
- It eliminates the need for a Local Network Gateway.
- It enables automatic route exchange, removing the need for manual route table updates. (Correct answer)
- It is required for all Point-to-Site VPN connections.
Correct answer: It enables automatic route exchange, removing the need for manual route table updates.
The main advantage of using BGP is that it provides dynamic routing. It allows the VPN gateway and on-premises VPN devices to automatically learn and advertise network routes, which eliminates the administrative overhead and potential for errors associated with manually maintaining static route tables.
Question 3: A network administrator is creating a new Azure VPN Gateway. They need to support dynamic routing and an active-active configuration. Which VPN Gateway SKU would NOT be suitable for this deployment?
- VpnGw1
- VpnGw2AZ
- Basic (Correct answer)
- VpnGw3
Correct answer: Basic
The Basic SKU for Azure VPN Gateway does not support BGP (Border Gateway Protocol), which is required for dynamic routing. Additionally, active-active configurations are not supported on the Basic SKU.
Question 4: An organization plans to implement a dual-redundancy hybrid connection with two on-premises VPN devices connecting to an Azure VPN Gateway. To achieve the highest level of availability with fully meshed tunnels, what is the recommended Azure VPN Gateway configuration?
- An active-standby gateway with two connections.
- A policy-based gateway with BGP.
- An active-active gateway with two local network gateways and two connections. (Correct answer)
- A single active-standby gateway with one local network gateway representing both on-premises devices.
Correct answer: An active-active gateway with two local network gateways and two connections.
For a dual-redundancy scenario with two on-premises devices, the best practice is to configure the Azure VPN Gateway in active-active mode. You would then create two separate local network gateways (one for each on-premises device) and establish two connections. This results in a full mesh of four IPsec tunnels, providing maximum redundancy.
Question 5: When configuring BGP on an Azure VPN Gateway for a hybrid connection, what is the purpose of the Autonomous System Number (ASN)?
- To identify the specific IPsec tunnel for routing.
- To uniquely identify the network for BGP routing. (Correct answer)
- To encrypt the BGP peering session.
- To define the static routes for the connection.
Correct answer: To uniquely identify the network for BGP routing.
In BGP, an Autonomous System Number (ASN) is a globally unique identifier for a network or a collection of networks under a single administrative domain. It is used to exchange routing information with other networks. Both the Azure VPN Gateway and the on-premises VPN device must have their own unique ASNs to establish a BGP peering session.
Question 6: Which of the following is a key requirement when changing an existing active-standby Azure VPN Gateway to an active-active configuration?
- The gateway must be a PolicyBased VPN type.
- A second public IP address must be assigned to the gateway. (Correct answer)
- The gateway SKU must be downgraded to Basic.
- BGP must be disabled before making the change.
Correct answer: A second public IP address must be assigned to the gateway.
An active-active gateway configuration requires two public IP addresses, one for each gateway instance. When converting from active-standby (which uses one public IP), a second public IP address must be created and associated with the gateway.
AZ-800 - Microsoft Azure Networking Solutions Hybrid VPN Gateway Design Questions and Answers
A company is designing a highly available hybrid network connection to Azure.
They require automatic failover for their Site-to-Site VPN connection.
Which Azure VPN Gateway configuration and routing protocol should be used to meet this requirement?