AZ-800 Hybrid VPN Gateway Design 4

Question 1

You are deploying a point-to-site VPN gateway for remote workers. The RADIUS server on-premises will handle authentication. Which P2S tunnel protocol supports RADIUS authentication?

Accepted Answer

SSTP and IKEv2

Answer

Both SSTP and IKEv2 support RADIUS-based authentication for point-to-site connections; OpenVPN uses certificate or Azure AD authentication.

Question 2

Which resource must be created in the GatewaySubnet before deploying an Azure VPN Gateway?

Accepted Answer

Nothing — the gateway is deployed directly into the GatewaySubnet

Answer

Azure VPN Gateway is deployed directly into the GatewaySubnet — no pre-existing resources are required; NSGs and UDRs on GatewaySubnet are not recommended.

Question 3

What is the minimum recommended size for the GatewaySubnet in an Azure VNet to support future scalability?

Accepted Answer

/27

Answer

Microsoft recommends a /27 or larger for GatewaySubnet to accommodate the gateway VMs and future configurations like active-active or ExpressRoute coexistence.

Question 4

A VPN gateway is configured with two tunnels in active-active mode. How does Azure handle traffic when one tunnel goes down?

Accepted Answer

All traffic fails over to the remaining active tunnel automatically

Answer

In active-active mode, both tunnels carry traffic simultaneously, and Azure automatically shifts all traffic to the remaining active tunnel if one fails.

Question 5

You need to allow split tunneling for P2S VPN clients so only traffic destined for the Azure VNet traverses the VPN. What must be configured?

Accepted Answer

Do not advertise a 0.0.0.0/0 route to P2S clients

Answer

Split tunneling is achieved by not advertising a default route (0.0.0.0/0) to P2S clients, so only VNet-destined traffic routes through the VPN.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Hybrid VPN Gateway Design 4