AZ-800 Hybrid VPN Gateway Design 2 — Questions and Answers
Question 1: Your organization needs a VPN gateway that supports active-active configuration for high availability. Which Azure VPN Gateway SKU is the MINIMUM required to enable active-active mode?
- Basic
- VpnGw1 (Correct answer)
- VpnGw2
- Standard
Correct answer: VpnGw1
Active-active mode requires VpnGw1 or higher; the Basic and Standard SKUs do not support this configuration.
Question 2: A company needs to connect 50 branch offices to Azure using a hub-and-spoke topology. Which VPN solution best minimizes management overhead for this scale?
- Individual site-to-site VPN connections per branch
- Azure Virtual WAN with VPN sites (Correct answer)
- One P2S gateway per branch
- ExpressRoute with private peering for each branch
Correct answer: Azure Virtual WAN with VPN sites
Azure Virtual WAN automates branch connectivity at scale using VPN sites, reducing per-branch management overhead significantly.
Question 3: When configuring a policy-based VPN gateway in Azure, which statement accurately describes its traffic selector behavior?
- It uses dynamic routing and supports multiple tunnels
- It uses static routing and creates a single tunnel with specific traffic selectors (Correct answer)
- It supports BGP and active-active configurations
- It uses IKEv2 and allows any-to-any traffic selectors
Correct answer: It uses static routing and creates a single tunnel with specific traffic selectors
Policy-based VPN gateways use static routing and define traffic selectors per tunnel, supporting only a single tunnel per connection.
Question 4: You need to configure a VPN gateway with a 99.99% SLA. What configuration is required?
- Single gateway in active-standby mode
- Zone-redundant gateway across availability zones (Correct answer)
- Two separate VPN gateways in different regions
- VPN gateway with ExpressRoute failover
Correct answer: Zone-redundant gateway across availability zones
Zone-redundant VPN gateways deployed across Azure Availability Zones provide the 99.99% SLA guarantee.
Question 5: A network engineer must allow on-premises clients to connect to Azure over point-to-site VPN using Azure Active Directory authentication. Which tunnel protocol is required?
- IKEv2
- SSTP
- L2TP/IPsec
- OpenVPN (Correct answer)
Correct answer: OpenVPN
Azure AD authentication for P2S VPN is only supported with the OpenVPN (SSL/TLS) tunnel protocol.
Question 6: Which BGP ASN is reserved by Azure for VPN Gateway use and cannot be used by customer on-premises devices?
- 65515 (Correct answer)
- 65000
- 64512
- 65535
Correct answer: 65515
Azure reserves ASN 65515 for its VPN Gateway; on-premises devices must use a different private or public ASN.
Question 7: An administrator is troubleshooting a site-to-site VPN that connects but drops intermittently. The on-premises firewall shows IKE phase 1 completing successfully but phase 2 failing. What is the MOST likely cause?
- Mismatched Pre-Shared Key
- Mismatched IPsec/IKE policy (phase 2 encryption/hashing) (Correct answer)
- Incorrect local network gateway IP address
- BGP ASN conflict between peers
Correct answer: Mismatched IPsec/IKE policy (phase 2 encryption/hashing)
IKE phase 2 (IPsec SA) failure while phase 1 succeeds indicates a mismatch in the IPsec policy parameters such as encryption algorithm, integrity algorithm, or PFS group.
AZ-800 Hybrid VPN Gateway Design 2
Your organization needs a VPN gateway that supports active-active configuration for high availability.
Which Azure VPN Gateway SKU is the MINIMUM required to enable active-active mode?