AZ-500 Question 61
Single answerYour company needs to establish secure connectivity between an on-premises network and an Azure virtual network using a site-to-site VPN. The on-premises firewall supports IKEv2 with a shared key. Additionally, remote employees need to connect securely to the same Azure vNET using point-to-site VPN. Which approach should you implement in Azure to meet both requirements with minimal complexity?
- A
Deploy an Azure route-based VPN gateway with a publicly routable IP address, then configure both site-to-site and point-to-site connections on that gateway.
- B
Deploy two separate Azure VPN gateways: a route-based gateway for site-to-site traffic and a policy-based gateway for point-to-site traffic.
- C
Deploy a policy-based VPN gateway for site-to-site connections and enable Azure Active Directory authentication for point-to-site on the same gateway.
- D
Require remote users to connect through the on-premises firewall over a site-to-site VPN, thus eliminating the need for a separate point-to-site configuration.
Show answer and explanation
Correct answer: A
Explanation
To support both site-to-site and point-to-site VPN connections on the same Azure VPN gateway, you must use a route-based VPN gateway. Policy-based gateways are limited to specific scenarios (e.g., older IKEv1 devices) and cannot concurrently host point-to-site connections. According to Azure documentation, a route-based gateway is required for point-to-site VPN configurations and can also handle IKEv2-based site-to-site tunnels. Reference: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings
- A. Correct.
Correct. A route-based VPN gateway in Azure supports IKEv2 and can handle site-to-site, point-to-site, and VNet-to-VNet connections simultaneously. This meets the requirement of using an IKEv2-based site-to-site VPN and allows remote employees to use a point-to-site VPN on the same gateway.
- B. Incorrect.
Incorrect. While you can deploy more than one VPN gateway, doing so adds unnecessary complexity. A single route-based gateway can accommodate both site-to-site and point-to-site connections without needing two separate gateways.
- C. Incorrect.
Incorrect. Policy-based gateways only support IKEv1, which is incompatible with the IKEv2 requirement. They also cannot concurrently host both site-to-site and point-to-site constructs on a single policy-based gateway.
- D. Incorrect.
Incorrect. For remote employees, routing traffic through the on-premises firewall (i.e., a 'hairpin' scenario) is less efficient and complicates the network design. Azure officially supports point-to-site VPNs directly to an Azure VPN gateway, which is simpler and more secure for roaming users.