AZ-800 Hybrid VPN Gateway Design 3 — Questions and Answers
Question 1: A VPN connection between Azure and an on-premises device suddenly stops passing traffic after 8 hours of uptime. No configuration changes were made. What should you check first?
- BGP session state on the local network gateway
- IKE SA lifetime mismatch causing renegotiation failure (Correct answer)
- Azure subscription quota limits
- Public IP address change on the VPN gateway
Correct answer: IKE SA lifetime mismatch causing renegotiation failure
An 8-hour cycle often indicates an IKE SA lifetime mismatch — when SA lifetime expires, the tunnel must renegotiate and mismatched settings can prevent successful reconnection.
Question 2: You need to connect your Azure VNet to an on-premises network where the VPN device does not support BGP. Which routing type must you use on the Azure VPN gateway?
- Route-based with BGP disabled (Correct answer)
- Policy-based
- Route-based with static routes only
- Either route-based or policy-based with BGP disabled
Correct answer: Route-based with BGP disabled
Route-based VPN gateways can operate without BGP using static routes, which is the appropriate choice when the on-premises device lacks BGP support.
Question 3: What is the purpose of the Local Network Gateway resource in an Azure site-to-site VPN configuration?
- It represents the Azure VNet address space
- It represents the on-premises VPN device IP and address prefixes (Correct answer)
- It stores the pre-shared key for the VPN connection
- It defines the BGP community values for route filtering
Correct answer: It represents the on-premises VPN device IP and address prefixes
The Local Network Gateway object in Azure defines the public IP address of the on-premises VPN device and the on-premises address prefixes reachable through that device.
Question 4: Your organization wants to use forced tunneling to route all internet-bound traffic from Azure VMs through an on-premises security appliance. Which configuration is required on the VPN gateway?
- Enable BGP and advertise a 0.0.0.0/0 default route from on-premises (Correct answer)
- Configure a UDR with 0.0.0.0/0 pointing to the VPN gateway subnet
- Set the gateway type to PolicyBased
- Enable active-active mode on the VPN gateway
Correct answer: Enable BGP and advertise a 0.0.0.0/0 default route from on-premises
Forced tunneling is achieved by advertising a 0.0.0.0/0 default route from on-premises via BGP, causing Azure VMs to route internet traffic back through the tunnel.
Question 5: Which Azure VPN Gateway SKU supports the highest aggregate throughput, reaching up to 10 Gbps?
- VpnGw3
- VpnGw4
- VpnGw5 (Correct answer)
- VpnGw5AZ
Correct answer: VpnGw5
VpnGw5 and VpnGw5AZ are the highest-tier SKUs, supporting up to 10 Gbps aggregate throughput.
Question 6: An engineer configures a VPN gateway with a custom IPsec policy specifying AES-256 encryption, SHA-256 integrity, and DHGroup14. The on-premises device uses AES-256, SHA-256, and DHGroup2. What will happen?
- The tunnel establishes using the stronger DHGroup14
- The tunnel fails because DH group values do not match (Correct answer)
- Azure automatically negotiates down to DHGroup2
- The tunnel establishes in policy-based mode automatically
Correct answer: The tunnel fails because DH group values do not match
When a custom IPsec policy is applied in Azure, both sides must use identical parameters; a DH group mismatch causes IKE negotiation to fail.
Question 7: A company uses ExpressRoute as its primary connection to Azure and wants to configure a site-to-site VPN as a failover path. What must be configured to enable automatic failover to VPN when ExpressRoute fails?
- Enable BFD on the ExpressRoute circuit
- Configure BGP to advertise less-specific routes over the VPN connection
- Set the VPN connection weight higher than the ExpressRoute connection
- Use a route-based VPN gateway and enable BGP with AS path prepending on the VPN (Correct answer)
Correct answer: Use a route-based VPN gateway and enable BGP with AS path prepending on the VPN
Using BGP with AS path prepending on the VPN connection makes the VPN routes less preferred than ExpressRoute routes, enabling automatic failover when ExpressRoute becomes unavailable.
AZ-800 Hybrid VPN Gateway Design 3
A VPN connection between Azure and an on-premises device suddenly stops passing traffic after 8 hours of uptime.
No configuration changes were made.
What should you check first?