AZ-305 Question 229
Single answerContoso has a large on-premises data center and wants to migrate several mission-critical applications to Azure. They require a dedicated private connection with predictable performance, guaranteed bandwidth, and an end-to-end service-level agreement (SLA). They also want to avoid sending application traffic over the public Internet. Which Azure connectivity solution should you recommend?
- A
Site-to-Site VPN using Azure VPN Gateway
- B
Azure ExpressRoute
- C
Point-to-Site VPN
- D
Azure Bastion
Show answer and explanation
Correct answer: B
Explanation
Azure ExpressRoute is designed to provide a private, dedicated path from on-premises datacenters to Azure. It offers predictable performance, flexible bandwidth options, and an SLA-backed service. Site-to-Site VPN and Point-to-Site VPN use the public Internet, making them less suitable for large-scale or latency-sensitive scenarios where guaranteed bandwidth is needed. Azure Bastion is specialized for remote management rather than enterprise connectivity. For more details, see the Microsoft Azure ExpressRoute documentation: https://docs.microsoft.com/azure/expressroute/
- A. Incorrect.
Option 1: Site-to-Site VPN using Azure VPN Gateway. This provides a secure tunnel over the public Internet but does not guarantee a dedicated bandwidth or end-to-end SLA. Performance can vary with Internet traffic conditions, so it does not meet Contoso’s requirement for predictable performance and guaranteed bandwidth.
- B. Correct.
Option 2: Azure ExpressRoute. This is the correct choice because it creates a private connection between on-premises environments and Azure. It can provide dedicated bandwidth, predictable performance, and a financially backed SLA. It avoids the public Internet, aligning with Contoso’s security and performance requirements.
- C. Incorrect.
Option 3: Point-to-Site VPN. While this can be used for individual client connections, it isn’t suitable for large-scale, mission-critical workloads that need a dedicated, high-bandwidth link. It also traverses the public Internet and thus does not meet the predictable performance and SLA needs.
- D. Incorrect.
Option 4: Azure Bastion. This service is used for secure RDP/SSH access to Azure virtual machines over the Azure portal and is not a connectivity solution for general on-premises to Azure traffic. It cannot fulfill Contoso’s requirement for a dedicated private connection.