AZ-305 Question 228
Select 2Your company is a global retailer that processes sensitive financial transactions and handles large data transfers between on-premises data centers and Azure. The CFO wants a dedicated, high-bandwidth connection with guaranteed uptime that bypasses the public Internet for production workloads. The CTO also requests a cost-effective secondary link for occasional testing and as a failover option if the primary link experiences service disruptions. Which two connectivity solutions should you recommend to meet these requirements?
- A
Configure Virtual Network (VNet) peering between the Azure VNet and the on-premises network
- B
Provision an ExpressRoute circuit
- C
Use a Point-to-Site VPN for all production traffic
- D
Deploy Azure Bastion to provide a secure RDP/SSH environment
- E
Implement a Site-to-Site VPN as a backup link
Show answer and explanation
Correct answers: B, E
Explanation
A dedicated ExpressRoute circuit addresses the need for high-bandwidth and private connectivity, bypassing the public Internet while offering service-level guarantees. A Site-to-Site VPN can add redundancy as a cost-effective failover or backup path. VNet peering only connects Azure resources within Azure, Point-to-Site VPN is better for individual client connections, and Azure Bastion provides secure RDP/SSH access but does not fulfill on-prem-to-Azure network connectivity requirements. For official guidelines, refer to Microsoft’s documentation on ExpressRoute (https://learn.microsoft.com/azure/expressroute/) and Site-to-Site VPN (https://learn.microsoft.com/azure/vpn-gateway/site-to-site-vpn-overview).
- A. Incorrect.
VNet peering is used to connect two Azure VNets within the Azure environment. It does not establish connectivity directly between on-premises data centers and Azure, so it does not meet the requirement of on-prem to Azure connectivity.
- B. Correct.
ExpressRoute provides dedicated, private connectivity to Azure with higher SLA guarantees and more reliable bandwidth than VPN-based solutions. This aligns perfectly with the CFO’s requirement for guaranteed uptime and avoiding the public Internet.
- C. Incorrect.
A Point-to-Site VPN is intended for individual client connections and is not suitable for high-volume production traffic. It does not address the CFO’s need for robust, always-available connectivity.
- D. Incorrect.
Azure Bastion securely provides RDP/SSH connectivity to virtual machines directly from the Azure portal. It does not establish an on-premises-to-Azure network connection, so it does not meet the stated requirements for data center connectivity.
- E. Correct.
A Site-to-Site VPN can serve as a more cost-effective and simpler backup solution compared to another ExpressRoute circuit. It can seamlessly route traffic between on-premises and Azure if the primary ExpressRoute link experiences an outage.