AZ-800 Hybrid VPN Gateway Design 5 — Questions and Answers
Question 1: A multi-national company wants to connect Azure regions across the globe using the Microsoft backbone network with VPN. Which service should they use?
- Global VNet Peering with VPN gateways
- Azure Virtual WAN with global transit routing (Correct answer)
- Multiple ExpressRoute circuits with Global Reach
- Site-to-site VPN between regional hubs
Correct answer: Azure Virtual WAN with global transit routing
Azure Virtual WAN provides global transit routing over the Microsoft backbone, connecting Azure regions and branches without requiring individual VPN gateway configurations between regions.
Question 2: You configure a VPN gateway connection and set the DPD (Dead Peer Detection) timeout. What happens when the DPD timeout expires without a response from the peer?
- The VPN connection is marked as degraded but traffic continues
- The IKE SA is deleted and the tunnel is torn down (Correct answer)
- Azure sends an alert but keeps the tunnel active
- The gateway switches to active-active mode automatically
Correct answer: The IKE SA is deleted and the tunnel is torn down
When DPD timeout expires without a peer response, Azure tears down the IKE SA and the tunnel, triggering re-establishment if configured.
Question 3: Which Azure Monitor metric should you use to monitor the bandwidth utilization of a VPN gateway tunnel?
- TunnelEgressBytes
- TunnelAverageBandwidth (Correct answer)
- GatewayP2SBandwidth
- TunnelPeakBandwidth
Correct answer: TunnelAverageBandwidth
TunnelAverageBandwidth metric in Azure Monitor provides the average bandwidth for a specific VPN tunnel, used to monitor utilization against the gateway SKU limit.
Question 4: A company needs to implement VPN gateway transit so that spoke VNets peered to a hub VNet can communicate with on-premises networks via the hub's VPN gateway. Which settings must be enabled?
- Enable gateway transit on the hub VNet peering and use remote gateways on spoke VNet peerings (Correct answer)
- Enable BGP on all spoke VNets and advertise routes to the hub
- Configure UDRs in each spoke pointing to the hub VPN gateway
- Enable Global Peering between all spoke VNets and the hub
Correct answer: Enable gateway transit on the hub VNet peering and use remote gateways on spoke VNet peerings
Gateway transit requires 'Allow Gateway Transit' on the hub side of the peering and 'Use Remote Gateways' on the spoke side of each peering.
Question 5: You need to verify that an Azure VPN gateway is successfully establishing BGP sessions with an on-premises peer. Which Azure CLI command shows the BGP peer status?
- az network vnet-gateway show-bgp-peer-status --resource-group MyRG --name MyGW (Correct answer)
- az network vpn-connection list-bgp-peers --gateway MyGW
- az network vnet-gateway get-bgp-peers --name MyGW
- az network vpn-gateway bgp-peers list --gateway-name MyGW
Correct answer: az network vnet-gateway show-bgp-peer-status --resource-group MyRG --name MyGW
The command 'az network vnet-gateway show-bgp-peer-status' retrieves the current BGP peer status for a virtual network gateway.
Question 6: An organization needs to ensure that its VPN gateway can support up to 30 site-to-site tunnels. Which minimum SKU should they select?
- VpnGw1 (Correct answer)
- VpnGw2
- VpnGw3
- VpnGw1AZ
Correct answer: VpnGw1
VpnGw1 supports up to 30 S2S tunnels, which meets the 30-tunnel requirement at the lowest cost tier.
Question 7: When coexisting ExpressRoute and site-to-site VPN connections on the same virtual network gateway, which gateway SKU is required?
- VpnGw1
- ErGw1AZ
- HighPerformance or UltraPerformance (legacy) or VpnGw1 and above with ExpressRoute feature (Correct answer)
- Standard
Correct answer: HighPerformance or UltraPerformance (legacy) or VpnGw1 and above with ExpressRoute feature
Coexistence of ExpressRoute and S2S VPN on the same VNet requires using compatible SKUs — specifically HighPerformance/UltraPerformance legacy SKUs or the current VpnGw1+ SKUs configured as a dual-purpose gateway.
AZ-800 Hybrid VPN Gateway Design 5
A multi-national company wants to connect Azure regions across the globe using the Microsoft backbone network with VPN.
Which service should they use?