AZ-800 Hybrid VPN Gateway Design 2

Question 1

Your organization needs a VPN gateway that supports active-active configuration for high availability. Which Azure VPN Gateway SKU is the MINIMUM required to enable active-active mode?

Accepted Answer

VpnGw1

Answer

Basic

Answer

VpnGw2

Answer

Standard

Question 2

A company needs to connect 50 branch offices to Azure using a hub-and-spoke topology. Which VPN solution best minimizes management overhead for this scale?

Accepted Answer

Azure Virtual WAN with VPN sites

Answer

Individual site-to-site VPN connections per branch

Answer

One P2S gateway per branch

Answer

ExpressRoute with private peering for each branch

Question 3

When configuring a policy-based VPN gateway in Azure, which statement accurately describes its traffic selector behavior?

Accepted Answer

It uses static routing and creates a single tunnel with specific traffic selectors

Answer

It uses dynamic routing and supports multiple tunnels

Answer

It supports BGP and active-active configurations

Answer

It uses IKEv2 and allows any-to-any traffic selectors

Question 4

You need to configure a VPN gateway with a 99.99% SLA. What configuration is required?

Accepted Answer

Zone-redundant gateway across availability zones

Answer

Single gateway in active-standby mode

Answer

Two separate VPN gateways in different regions

Answer

VPN gateway with ExpressRoute failover

Question 5

A network engineer must allow on-premises clients to connect to Azure over point-to-site VPN using Azure Active Directory authentication. Which tunnel protocol is required?

Accepted Answer

OpenVPN

Answer

IKEv2

Answer

SSTP

Answer

L2TP/IPsec

Question 6

Which BGP ASN is reserved by Azure for VPN Gateway use and cannot be used by customer on-premises devices?

Accepted Answer

65515

Answer

65000

Answer

64512

Answer

65535

Question 7

An administrator is troubleshooting a site-to-site VPN that connects but drops intermittently. The on-premises firewall shows IKE phase 1 completing successfully but phase 2 failing. What is the MOST likely cause?

Accepted Answer

Mismatched IPsec/IKE policy (phase 2 encryption/hashing)

Answer

Mismatched Pre-Shared Key

Answer

Incorrect local network gateway IP address

Answer

BGP ASN conflict between peers