AZ-800 Hybrid VPN Gateway Design 4 — Questions and Answers
Question 1: You are deploying a point-to-site VPN gateway for remote workers. The RADIUS server on-premises will handle authentication. Which P2S tunnel protocol supports RADIUS authentication?
- OpenVPN only
- SSTP only
- IKEv2 only
- SSTP and IKEv2 (Correct answer)
Correct answer: SSTP and IKEv2
Both SSTP and IKEv2 support RADIUS-based authentication for point-to-site connections; OpenVPN uses certificate or Azure AD authentication.
Question 2: Which resource must be created in the GatewaySubnet before deploying an Azure VPN Gateway?
- Nothing — the gateway is deployed directly into the GatewaySubnet (Correct answer)
- A Network Security Group with inbound rules for IKE ports
- A route table with a default route to the internet
- A public IP address associated with the subnet
Correct answer: Nothing — the gateway is deployed directly into the GatewaySubnet
Azure VPN Gateway is deployed directly into the GatewaySubnet — no pre-existing resources are required; NSGs and UDRs on GatewaySubnet are not recommended.
Question 3: What is the minimum recommended size for the GatewaySubnet in an Azure VNet to support future scalability?
- /32
- /29
- /27 (Correct answer)
- /24
Correct answer: /27
Microsoft recommends a /27 or larger for GatewaySubnet to accommodate the gateway VMs and future configurations like active-active or ExpressRoute coexistence.
Question 4: A VPN gateway is configured with two tunnels in active-active mode. How does Azure handle traffic when one tunnel goes down?
- All traffic fails over to the remaining active tunnel automatically (Correct answer)
- Traffic is dropped until the failed tunnel is manually restored
- Azure creates a new standby tunnel to replace the failed one
- BGP sessions are terminated and must be restarted manually
Correct answer: All traffic fails over to the remaining active tunnel automatically
In active-active mode, both tunnels carry traffic simultaneously, and Azure automatically shifts all traffic to the remaining active tunnel if one fails.
Question 5: You need to allow split tunneling for P2S VPN clients so only traffic destined for the Azure VNet traverses the VPN. What must be configured?
- Disable BGP on the P2S gateway
- Do not advertise a 0.0.0.0/0 route to P2S clients (Correct answer)
- Enable forced tunneling on the gateway
- Use a policy-based gateway for P2S connections
Correct answer: Do not advertise a 0.0.0.0/0 route to P2S clients
Split tunneling is achieved by not advertising a default route (0.0.0.0/0) to P2S clients, so only VNet-destined traffic routes through the VPN.
Question 6: An on-premises device uses a dynamic public IP address that changes periodically. How should the Local Network Gateway be configured to handle this?
- Use a FQDN instead of an IP address for the on-premises gateway (Correct answer)
- Configure a static BGP peer IP on the on-premises device
- Use an anycast IP address on the Azure VPN gateway
- Enable active-active on the Azure VPN gateway
Correct answer: Use a FQDN instead of an IP address for the on-premises gateway
Azure Local Network Gateway supports specifying a fully qualified domain name (FQDN) for the on-premises device, which resolves dynamically when the IP changes.
Question 7: Which Azure CLI command correctly creates a VPN connection between a virtual network gateway and a local network gateway?
- az network vpn-connection create --name MyConn --resource-group MyRG --vnet-gateway1 MyGW --local-gateway2 MyLNG --shared-key MyPSK (Correct answer)
- az network gateway connection create --vnet MyVNet --local-gw MyLNG --psk MyPSK
- az network vpn-gateway connection add --gateway-name MyGW --lng MyLNG
- az network vnet-gateway connect --gateway MyGW --remote MyLNG --key MyPSK
Correct answer: az network vpn-connection create --name MyConn --resource-group MyRG --vnet-gateway1 MyGW --local-gateway2 MyLNG --shared-key MyPSK
The correct command is 'az network vpn-connection create' with parameters specifying the virtual network gateway, local network gateway, and shared key.
AZ-800 Hybrid VPN Gateway Design 4
You are deploying a point-to-site VPN gateway for remote workers.
The RADIUS server on-premises will handle authentication.
Which P2S tunnel protocol supports RADIUS authentication?