AZ-800 ExpressRoute Circuit Configuration 4 — Questions and Answers
Question 1: You are troubleshooting an ExpressRoute circuit where BGP is established but no routes are being received. Private peering is configured correctly. What should you check first?
- The ExpressRoute gateway SKU
- Whether the on-premises router is advertising routes via BGP (Correct answer)
- The virtual network address space
- The ExpressRoute circuit bandwidth setting
Correct answer: Whether the on-premises router is advertising routes via BGP
If BGP is established but no routes appear, the on-premises router may not be configured to advertise any prefixes to Azure via BGP.
Question 2: What is ExpressRoute FastPath designed to improve in an ExpressRoute connection?
- The speed of circuit provisioning
- Network throughput and latency by bypassing the gateway for data plane traffic (Correct answer)
- BGP convergence time after a link failure
- The number of supported BGP prefixes
Correct answer: Network throughput and latency by bypassing the gateway for data plane traffic
ExpressRoute FastPath bypasses the virtual network gateway for data path traffic, sending packets directly to VMs to improve throughput and reduce latency.
Question 3: An organization has an ExpressRoute Standard circuit. They need to connect VNets in different geopolitical regions. What upgrade is required?
- Upgrade to a higher bandwidth tier
- Enable ExpressRoute Global Reach
- Upgrade to ExpressRoute Premium add-on (Correct answer)
- Migrate to ExpressRoute Direct
Correct answer: Upgrade to ExpressRoute Premium add-on
ExpressRoute Premium add-on is required to connect VNets across geopolitical region boundaries from a single circuit.
Question 4: Which of the following BGP ASNs is reserved by Microsoft and cannot be used for customer-configured ExpressRoute private peering?
- 65000
- 65515 (Correct answer)
- 64512
- 65100
Correct answer: 65515
ASN 65515 is reserved for the Azure ExpressRoute gateway and cannot be used by customers for private peering configuration.
Question 5: You need to verify that an ExpressRoute circuit's ARP tables are populated correctly for private peering. Which Azure tool allows you to retrieve the ARP tables directly?
- Azure Network Watcher Connection Monitor
- Azure Portal ExpressRoute circuit diagnostics
- Azure CLI command 'az network express-route get-peering-stats'
- Azure CLI command 'az network express-route list-arp-tables' (Correct answer)
Correct answer: Azure CLI command 'az network express-route list-arp-tables'
The Azure CLI command 'az network express-route list-arp-tables' retrieves ARP table information for verifying Layer 2 connectivity on an ExpressRoute circuit.
Question 6: MACsec is available on which type of ExpressRoute connection for encrypting traffic at Layer 2?
- Any ExpressRoute circuit through a provider
- ExpressRoute circuits using CloudExchange co-location only
- ExpressRoute Direct connections only (Correct answer)
- ExpressRoute circuits with Premium add-on
Correct answer: ExpressRoute Direct connections only
MACsec (IEEE 802.1AE) encryption is only available on ExpressRoute Direct ports, which provide direct physical connectivity to Microsoft's routers.
Question 7: An ExpressRoute circuit shows 'Circuit status: Enabled' but 'Provider status: Provisioned' and connectivity is still failing. What is the most likely next troubleshooting step?
- Delete and recreate the circuit
- Verify BGP configuration on both the customer edge router and Azure gateway (Correct answer)
- Increase the circuit bandwidth
- Enable ExpressRoute Premium
Correct answer: Verify BGP configuration on both the customer edge router and Azure gateway
When both sides show provisioned/enabled, connectivity failures typically indicate BGP misconfiguration on the customer router or missing gateway connection in Azure.
AZ-800 ExpressRoute Circuit Configuration 4
You are troubleshooting an ExpressRoute circuit where BGP is established but no routes are being received.
Private peering is configured correctly.
What should you check first?