AZ-800 Azure Virtual WAN Implementation 3 — Questions and Answers
Question 1: A company deploys Virtual WAN with multiple hubs and needs to isolate spoke VNets so they can only communicate with on-premises, not with other spokes. Which feature enables this isolation?
- Network security groups on spoke VNets
- Custom route tables with propagation control (Correct answer)
- Azure Firewall DNAT rules
- Hub peering policies
Correct answer: Custom route tables with propagation control
Custom route tables with selective propagation allow spoke VNets to communicate only with specific connections like on-premises while being isolated from other spokes.
Question 2: When connecting a VNet to a Virtual WAN hub, what routing option allows the VNet to use the hub's default routes without any additional configuration?
- Static route injection
- Route association to defaultRouteTable (Correct answer)
- BGP route reflection
- Custom peering policies
Correct answer: Route association to defaultRouteTable
Associating the VNet connection to the defaultRouteTable means the VNet uses the hub's standard routing without requiring custom tables.
Question 3: A Virtual WAN deployment spans US East and West Europe hubs. A branch in Europe needs to access an Azure VM in US East. What must be enabled for this traffic path?
- Global reach on ExpressRoute
- Inter-hub connectivity through the Virtual WAN backbone (Correct answer)
- VNet global peering between hub VNets
- Dedicated ExpressRoute between regions
Correct answer: Inter-hub connectivity through the Virtual WAN backbone
Virtual WAN automatically provides inter-hub connectivity through its Microsoft backbone, allowing traffic to traverse between hubs in different regions.
Question 4: Which Azure CLI command correctly creates a Virtual WAN resource in the 'rg-networking' resource group?
- az network vwan create --name myVWAN --resource-group rg-networking --type Standard (Correct answer)
- az network wan create --name myVWAN --resource-group rg-networking
- az network virtual-wan new --name myVWAN --rg rg-networking --sku Standard
- az network vhub create --name myVWAN --resource-group rg-networking
Correct answer: az network vwan create --name myVWAN --resource-group rg-networking --type Standard
The correct command is 'az network vwan create' with '--name', '--resource-group', and '--type' parameters to specify the Virtual WAN SKU.
Question 5: An organization needs Point-to-Site (P2S) VPN for remote workers connecting through Virtual WAN. Which authentication methods are supported for P2S in Virtual WAN?
- Azure AD authentication only
- Certificate-based authentication only
- Azure AD, certificate-based, and RADIUS authentication (Correct answer)
- RADIUS authentication only
Correct answer: Azure AD, certificate-based, and RADIUS authentication
Virtual WAN P2S gateways support Azure AD (for OpenVPN), certificate-based authentication, and RADIUS server authentication for remote user connections.
Question 6: A network team needs to connect an SD-WAN device to Azure Virtual WAN without using VPN. Which connectivity option supports this for compatible SD-WAN partners?
- Software-Defined WAN partner integration via NVA in the hub (Correct answer)
- Azure Route Server integration
- Direct Express Route connection only
- Azure Virtual Network Gateway BGP peering
Correct answer: Software-Defined WAN partner integration via NVA in the hub
Azure Virtual WAN supports certified SD-WAN Network Virtual Appliances (NVAs) deployed directly in the hub for native SD-WAN integration.
Question 7: What is the maximum number of VNet connections supported per Virtual WAN hub?
- 100
- 250 (Correct answer)
- 500
- 1000
Correct answer: 250
A single Virtual WAN hub supports up to 500 virtual network connections, providing large-scale connectivity for enterprise deployments.
AZ-800 Azure Virtual WAN Implementation 3
A company deploys Virtual WAN with multiple hubs and needs to isolate spoke VNets so they can only communicate with on-premises, not with other spokes.
Which feature enables this isolation?