AZ-800 Hybrid VPN Gateway Design 4

Question 1

You are deploying a point-to-site VPN gateway for remote workers. The RADIUS server on-premises will handle authentication. Which P2S tunnel protocol supports RADIUS authentication?

Accepted Answer

SSTP and IKEv2

Answer

OpenVPN only

Answer

SSTP only

Answer

IKEv2 only

Question 2

Which resource must be created in the GatewaySubnet before deploying an Azure VPN Gateway?

Accepted Answer

Nothing — the gateway is deployed directly into the GatewaySubnet

Answer

A Network Security Group with inbound rules for IKE ports

Answer

A route table with a default route to the internet

Answer

A public IP address associated with the subnet

Question 3

What is the minimum recommended size for the GatewaySubnet in an Azure VNet to support future scalability?

Accepted Answer

/27

Answer

/32

Answer

/29

Answer

/24

Question 4

A VPN gateway is configured with two tunnels in active-active mode. How does Azure handle traffic when one tunnel goes down?

Accepted Answer

All traffic fails over to the remaining active tunnel automatically

Answer

Traffic is dropped until the failed tunnel is manually restored

Answer

Azure creates a new standby tunnel to replace the failed one

Answer

BGP sessions are terminated and must be restarted manually

Question 5

You need to allow split tunneling for P2S VPN clients so only traffic destined for the Azure VNet traverses the VPN. What must be configured?

Accepted Answer

Do not advertise a 0.0.0.0/0 route to P2S clients

Answer

Disable BGP on the P2S gateway

Answer

Enable forced tunneling on the gateway

Answer

Use a policy-based gateway for P2S connections

Question 6

An on-premises device uses a dynamic public IP address that changes periodically. How should the Local Network Gateway be configured to handle this?

Accepted Answer

Use a FQDN instead of an IP address for the on-premises gateway

Answer

Configure a static BGP peer IP on the on-premises device

Answer

Use an anycast IP address on the Azure VPN gateway

Answer

Enable active-active on the Azure VPN gateway

Question 7

Which Azure CLI command correctly creates a VPN connection between a virtual network gateway and a local network gateway?

Accepted Answer

az network vpn-connection create --name MyConn --resource-group MyRG --vnet-gateway1 MyGW --local-gateway2 MyLNG --shared-key MyPSK

Answer

az network gateway connection create --vnet MyVNet --local-gw MyLNG --psk MyPSK

Answer

az network vpn-gateway connection add --gateway-name MyGW --lng MyLNG

Answer

az network vnet-gateway connect --gateway MyGW --remote MyLNG --key MyPSK