AZ-800 Hybrid VPN Gateway Design 3

Question 1

A VPN connection between Azure and an on-premises device suddenly stops passing traffic after 8 hours of uptime. No configuration changes were made. What should you check first?

Accepted Answer

IKE SA lifetime mismatch causing renegotiation failure

Answer

BGP session state on the local network gateway

Answer

Azure subscription quota limits

Answer

Public IP address change on the VPN gateway

Question 2

You need to connect your Azure VNet to an on-premises network where the VPN device does not support BGP. Which routing type must you use on the Azure VPN gateway?

Accepted Answer

Route-based with BGP disabled

Answer

Policy-based

Answer

Route-based with static routes only

Answer

Either route-based or policy-based with BGP disabled

Question 3

What is the purpose of the Local Network Gateway resource in an Azure site-to-site VPN configuration?

Accepted Answer

It represents the on-premises VPN device IP and address prefixes

Answer

It represents the Azure VNet address space

Answer

It stores the pre-shared key for the VPN connection

Answer

It defines the BGP community values for route filtering

Question 4

Your organization wants to use forced tunneling to route all internet-bound traffic from Azure VMs through an on-premises security appliance. Which configuration is required on the VPN gateway?

Accepted Answer

Enable BGP and advertise a 0.0.0.0/0 default route from on-premises

Answer

Configure a UDR with 0.0.0.0/0 pointing to the VPN gateway subnet

Answer

Set the gateway type to PolicyBased

Answer

Enable active-active mode on the VPN gateway

Question 5

Which Azure VPN Gateway SKU supports the highest aggregate throughput, reaching up to 10 Gbps?

Accepted Answer

VpnGw5

Answer

VpnGw3

Answer

VpnGw4

Answer

VpnGw5AZ

Question 6

An engineer configures a VPN gateway with a custom IPsec policy specifying AES-256 encryption, SHA-256 integrity, and DHGroup14. The on-premises device uses AES-256, SHA-256, and DHGroup2. What will happen?

Accepted Answer

The tunnel fails because DH group values do not match

Answer

The tunnel establishes using the stronger DHGroup14

Answer

Azure automatically negotiates down to DHGroup2

Answer

The tunnel establishes in policy-based mode automatically

Question 7

A company uses ExpressRoute as its primary connection to Azure and wants to configure a site-to-site VPN as a failover path. What must be configured to enable automatic failover to VPN when ExpressRoute fails?

Accepted Answer

Use a route-based VPN gateway and enable BGP with AS path prepending on the VPN

Answer

Enable BFD on the ExpressRoute circuit

Answer

Configure BGP to advertise less-specific routes over the VPN connection

Answer

Set the VPN connection weight higher than the ExpressRoute connection