AZ-305 Question 230
Single answerA manufacturing company must establish a private, high-throughput connection between their on-premises data center and their Azure virtual networks. Due to regulatory requirements, the connection should not traverse the public Internet. Which connectivity solution should they implement to meet these requirements?
- A
Site-to-Site (S2S) VPN using the built-in Azure VPN Gateway
- B
Azure ExpressRoute
- C
Azure Virtual WAN with VPN-based connectivity
- D
Azure Private Link
Show answer and explanation
Correct answer: B
Explanation
Azure ExpressRoute provides private connectivity to Microsoft Azure data centers, avoiding public Internet routing. Such direct circuits offer higher security, predictable bandwidth, and more reliable performance. Microsoft documentation (https://learn.microsoft.com/azure/expressroute/expressroute-introduction) recommends ExpressRoute for scenarios requiring stringent compliance, dedicated throughput, and minimized latency.
- A. Incorrect.
Option 1 (Site-to-Site VPN) uses IPsec tunnels over the public Internet. Although it is often a cost-effective option, it does not provide a dedicated private link or strict SLAs, which is crucial for regulatory requirements that prohibit public Internet traversal.
- B. Correct.
Option 2 (Azure ExpressRoute) is correct. It provides a private, dedicated connection that doesn't traverse the public Internet and offers predictable performance, higher bandwidth, and an SLA that meets strict regulatory compliance needs.
- C. Incorrect.
Option 3 (Azure Virtual WAN with VPN-based connectivity) might simplify branch connectivity, but traffic still goes over the public Internet via IPsec tunnels. It doesn't guarantee a dedicated path or the level of performance required for the scenario.
- D. Incorrect.
Option 4 (Azure Private Link) secures access to specific Azure services (such as Azure Storage or Azure SQL) over a private endpoint. It doesn't provide a full network connection from on-premises to an Azure virtual network or handle all inbound and outbound traffic as required here.