AZ-500 Question 56
Single answerYou have two Azure Virtual Networks (VNetA in East US and VNetB in West US). VNetA is already connected to your on-premises network using a VPN gateway. You want VNetB to communicate with on-premises resources through the existing VPN gateway in VNetA, without deploying an additional gateway. Which configuration option is the most appropriate?
- A
Peer VNetA and VNetB and enable ‘Use remote gateways’ on VNetB
- B
Set up an application gateway in VNetB and forward traffic to VNetA
- C
Deploy a separate VPN gateway in VNetB and then peer with VNetA
- D
Configure VNetB for VNet-to-VNet VPN with VNetA without peering
Show answer and explanation
Correct answer: A
Explanation
The recommended solution when you already have a functioning VPN gateway in one VNet is to use VNet Peering with gateway transit enabled. In Azure, you configure 'Allow gateway transit' on the VNet that has the VPN gateway (VNetA) and 'Use remote gateways' on the peered VNet (VNetB). This setup ensures VNetB can route traffic to the on-premises network through VNetA’s existing VPN gateway. For more details, see the official Microsoft documentation on VNet peering and gateway transit (https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview).
- A. Correct.
Correct. By peering VNetB to VNetA and configuring ‘Use remote gateways’ on VNetB (while VNetA is set to ‘Allow gateway transit’), VNetB can use VNetA’s existing VPN gateway. This approach avoids extra costs and deployment overhead.
- B. Incorrect.
Incorrect. An application gateway is designed primarily for routing HTTP/HTTPS traffic at Layer 7, not for providing site-to-site connectivity with on-premises networks through an existing VPN gateway.
- C. Incorrect.
Incorrect. Deploying another VPN gateway in VNetB is unnecessary. While technically feasible, it duplicates resources and increases costs instead of leveraging the existing gateway in VNetA.
- D. Incorrect.
Incorrect. Establishing a VNet-to-VNet VPN alone does not allow VNetB to inherit on-premises connectivity from VNetA’s gateway unless peering and gateway transit are explicitly configured.