AZ-800 Azure Virtual WAN Implementation 5 — Questions and Answers
Question 1: A company has a Virtual WAN deployment and needs to force-tunnel all internet traffic from branch VPN sites through an on-premises firewall. Which configuration achieves this?
- Configure a 0.0.0.0/0 static route on the VPN site pointing to on-premises
- Enable branch-to-branch on the hub and advertise a default route from on-premises via BGP (Correct answer)
- Add a UDR on the hub with next hop as on-premises
- Enable internet traffic routing intent pointing to on-premises
Correct answer: Enable branch-to-branch on the hub and advertise a default route from on-premises via BGP
By enabling branch-to-branch and having the on-premises router advertise 0.0.0.0/0 via BGP, all internet traffic from branch sites is routed back through on-premises.
Question 2: A network architect needs to ensure spoke VNets in Virtual WAN can use a third-party NVA for packet inspection instead of Azure Firewall. The NVA is deployed in a spoke VNet. Which approach is supported?
- Deploy the NVA directly inside the Virtual WAN hub
- Use custom route tables to steer traffic through the NVA spoke VNet via static routes (Correct answer)
- Configure ExpressRoute to route through the NVA
- Virtual WAN only supports Azure Firewall for inspection
Correct answer: Use custom route tables to steer traffic through the NVA spoke VNet via static routes
Custom route tables with static routes pointing to the NVA's private IP in a spoke VNet allow traffic steering through third-party NVAs in non-hub VNets.
Question 3: When deploying a Virtual WAN hub, which resource is automatically created and managed by Microsoft within the hub virtual network?
- User-managed VPN gateway with public IP
- Microsoft-managed router infrastructure and gateway resources (Correct answer)
- Azure Load Balancer for branch traffic
- User-defined route tables for each connection
Correct answer: Microsoft-managed router infrastructure and gateway resources
Microsoft automatically deploys and manages the hub's router infrastructure, VPN gateways, ExpressRoute gateways, and other networking components inside the hub VNet.
Question 4: An enterprise uses Virtual WAN Standard with 10 hubs globally. They need to limit which spoke VNets can communicate with specific on-premises sites. Which Virtual WAN feature enables this traffic segmentation?
- Network security groups on hub subnets
- Custom routing tables with selective association and propagation (Correct answer)
- Azure Policy with network deny rules
- ExpressRoute circuit-level filtering
Correct answer: Custom routing tables with selective association and propagation
Custom routing tables allow granular control by defining which connections associate (receive routes from) and propagate (advertise routes to) specific tables, enabling traffic segmentation.
Question 5: A Virtual WAN VPN gateway is configured with active-active mode. What is the primary benefit of this configuration?
- It doubles the throughput capacity and provides redundancy through two active tunnel endpoints (Correct answer)
- It reduces BGP convergence time only
- It allows connections to two different on-premises devices simultaneously
- It enables split tunneling for P2S clients
Correct answer: It doubles the throughput capacity and provides redundancy through two active tunnel endpoints
Active-active VPN gateway mode provides both higher aggregate throughput and higher availability by maintaining two active BGP/IPsec endpoints simultaneously.
Question 6: A company migrating from a hub-and-spoke VNet topology to Virtual WAN wants to reuse existing VNet peerings. What must they do before connecting existing VNets to a Virtual WAN hub?
- Delete all existing VNet peerings between the hub and spoke VNets first (Correct answer)
- Export the existing route tables and import them into Virtual WAN
- Upgrade VNet gateway SKUs to VpnGw1 minimum
- Convert the existing hub VNet into a Virtual WAN hub
Correct answer: Delete all existing VNet peerings between the hub and spoke VNets first
Existing VNet peerings between a hub VNet and spoke VNets must be removed before connecting those VNets to a Virtual WAN hub, as Virtual WAN creates its own managed peerings.
Question 7: A network engineer needs to verify that a Virtual WAN hub is correctly propagating routes to connected VNets. Which tool in the Azure portal provides an end-to-end view of effective routes for a hub connection?
- Network Watcher IP flow verify
- Virtual WAN hub 'Effective Routes' view for each connection (Correct answer)
- Route table blade on the spoke VNet
- Azure Monitor Network Insights topology map
Correct answer: Virtual WAN hub 'Effective Routes' view for each connection
The 'Effective Routes' view on a Virtual WAN hub connection shows all routes being propagated to that connection, enabling route troubleshooting.
AZ-800 Azure Virtual WAN Implementation 5
A company has a Virtual WAN deployment and needs to force-tunnel all internet traffic from branch VPN sites through an on-premises firewall.
Which configuration achieves this?