AZ-305 Question 221
Select 2You are designing a new network solution for a globally distributed application that spans two Azure regions. Your organization also has an on-premises data center that must be securely accessible from both Azure regions. The solution must ensure minimal latency for cross-region traffic and a reliable, secure connection to on-premises resources without incurring unnecessary overhead. Which two actions should you take to achieve these requirements?
- A
- Implement Global VNet Peering between the two Azure VNets
- B
- Deploy an Azure Firewall in each VNet to manage cross-region traffic
- C
- Deploy a single ExpressRoute Gateway in a hub VNet and connect your on-premises environment to that gateway
- D
- Configure forced tunneling so that all cross-region traffic is routed to on-premises
Show answer and explanation
Correct answers: A, C
Explanation
Global VNet Peering seamlessly connects two Azure VNets in different regions with minimal latency, satisfying the cross-region communication requirement. For secure and reliable access to your on-premises network, using a central ExpressRoute Gateway in a hub VNet aligns with best practices for hub-and-spoke architecture. The combination of Global VNet Peering for inter-region connectivity and a single ExpressRoute Gateway for on-premises connectivity optimizes performance and reduces overhead. For more information, refer to Microsoft documentation on Global VNet Peering (https://docs.microsoft.com/azure/virtual-network/virtual-network-peering-overview) and ExpressRoute (https://docs.microsoft.com/azure/expressroute/expressroute-introduction).
- A. Correct.
- Implement Global VNet Peering between the two Azure VNets: CORRECT. Global VNet Peering provides a seamless connection with high bandwidth and low latency between VNets in different regions. It is a cost-effective and straightforward way to enable cross-region communication without the overhead of gateways.
- B. Incorrect.
- Deploy an Azure Firewall in each VNet to manage cross-region traffic: INCORRECT. While an Azure Firewall can control and secure inbound and outbound traffic, it does not itself provide a low-latency cross-region connection. It may add additional operational overhead if the goal is purely to establish a private, performant connection between VNets.
- C. Correct.
- Deploy a single ExpressRoute Gateway in a hub VNet and connect your on-premises environment to that gateway: CORRECT. By having a hub VNet with an ExpressRoute Gateway, you can connect on-premises resources to Azure privately. Peering your spoke VNets (in different regions) to the hub VNet allows secure communication from on-premises to Azure resources without additional gateways in each VNet.
- D. Incorrect.
- Configure forced tunneling so that all cross-region traffic is routed to on-premises: INCORRECT. Forced tunneling would route non-local traffic back to on-premises, causing increased latency and complexity. This approach contradicts the requirement for minimal latency between Azure regions.