AZ-800 Azure Virtual WAN Implementation 4 — Questions and Answers
Question 1: A company's Virtual WAN has a secured hub with Azure Firewall. They want internet traffic from spoke VNets to egress through the firewall. Which routing intent policy achieves this?
- Private traffic policy only
- Internet traffic policy only (Correct answer)
- Both private and internet traffic policies
- Custom UDR on each spoke VNet
Correct answer: Internet traffic policy only
Configuring the internet traffic routing intent policy on the secured hub routes all internet-bound traffic from connected VNets through Azure Firewall.
Question 2: An enterprise uses Virtual WAN and wants BGP to exchange routes automatically between their on-premises router and Azure. What is required on the VPN site configuration?
- Static routes must be defined manually
- BGP must be enabled on the VPN site with ASN and BGP peering address (Correct answer)
- ExpressRoute must be used instead of VPN for BGP
- BGP is automatically enabled on all VPN sites
Correct answer: BGP must be enabled on the VPN site with ASN and BGP peering address
To use BGP with Site-to-Site VPN in Virtual WAN, you must enable BGP on the VPN site and provide the on-premises router's ASN and BGP peering IP address.
Question 3: When planning Virtual WAN hub gateway scale units for VPN, what does each scale unit represent in terms of aggregate throughput?
- 100 Mbps
- 500 Mbps
- 1 Gbps (Correct answer)
- 2 Gbps
Correct answer: 1 Gbps
Each VPN gateway scale unit in Virtual WAN provides 1 Gbps of aggregate throughput, and you can configure 1 to 20 scale units per hub.
Question 4: A branch VPN site is connected to Virtual WAN but the connection shows 'Not Connected' status. The VPN device uses IKEv2. Which parameter mismatch most commonly causes this issue?
- BGP ASN mismatch
- IPsec/IKE policy parameter mismatch between the device and Azure (Correct answer)
- Incorrect resource group assignment
- Missing route table association
Correct answer: IPsec/IKE policy parameter mismatch between the device and Azure
IPsec/IKE policy mismatches (encryption, integrity, DH group, PFS) between the on-premises VPN device and Azure are the most common cause of IKEv2 connection failures.
Question 5: A company deploys Azure Virtual WAN and wants to monitor hub-to-hub latency and traffic metrics. Which Azure service provides this telemetry?
- Azure Network Watcher Connection Monitor
- Azure Monitor Metrics for Virtual WAN (Correct answer)
- Log Analytics with NSG flow logs
- Azure Traffic Analytics only
Correct answer: Azure Monitor Metrics for Virtual WAN
Azure Monitor provides built-in metrics for Virtual WAN including hub throughput, gateway tunnel metrics, and BGP peer status.
Question 6: An organization needs to connect an on-premises data center to Virtual WAN using ExpressRoute with a private peering circuit. After connecting the circuit to the hub, traffic still doesn't flow to spoke VNets. What is the most likely missing configuration?
- ExpressRoute Global Reach must be enabled
- The hub routing table must have the VNet connections propagating to it (Correct answer)
- Azure Firewall must be deployed in the hub
- ExpressRoute premium add-on must be activated
Correct answer: The hub routing table must have the VNet connections propagating to it
For traffic to flow from ExpressRoute to spoke VNets, the VNet connections must propagate routes to the same routing table that the ExpressRoute connection associates with.
Question 7: Virtual WAN hubs in two different regions need to exchange routes through the Microsoft backbone. Which protocol does Azure use internally for hub-to-hub route exchange?
- OSPF
- BGP (Correct answer)
- IS-IS
- RIP
Correct answer: BGP
Azure Virtual WAN uses BGP internally between hubs to exchange routing information across the Microsoft global backbone network.
AZ-800 Azure Virtual WAN Implementation 4
A company's Virtual WAN has a secured hub with Azure Firewall.
They want internet traffic from spoke VNets to egress through the firewall.
Which routing intent policy achieves this?