AZ-500 Question 63
Single answerA company wants to configure secure VPN connectivity between their on-premises data center and Azure, as well as provide remote users with a secure way to access Azure resources. They plan to create a site-to-site VPN for the data center connection and a point-to-site VPN for remote employees. The IT security team requires that only Azure AD–authenticated users on domain-joined devices are allowed to connect via the point-to-site VPN. Which approach best meets these requirements?
- A
Use a policy-based VPN gateway for the site-to-site connection and self-signed certificates for the point-to-site connection.
- B
Deploy a route-based VPN gateway for both site-to-site and point-to-site connections, configure Azure AD authentication for remote users, and enforce device compliance using Azure AD Conditional Access.
- C
Implement the site-to-site VPN gateway with a pre-shared key and rely on VPN client pass-through authentication for the point-to-site connection without additional requirements.
- D
Set up an ExpressRoute circuit for on-premises connectivity and configure point-to-site connections to authenticate against on-premises Active Directory only.
Show answer and explanation
Correct answer: B
Explanation
In this scenario, a route-based VPN gateway supports both site-to-site connectivity for on-premises data centers and point-to-site connections for remote users. Azure AD authentication for point-to-site VPNs allows applying Conditional Access policies and ensuring that devices meet compliance requirements, including being domain-joined. References: Microsoft Learn documentation on Azure VPN Gateway (https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings).
- A. Incorrect.
Option 1 is incorrect because a policy-based VPN gateway does not support point-to-site connections, and relying only on self-signed certificates would not integrate with Azure AD device compliance requirements.
- B. Correct.
Option 2 is correct. A route-based VPN gateway can support both site-to-site and point-to-site connections. Configuring Azure AD authentication for point-to-site allows leveraging Conditional Access policies to enforce device compliance for domain-joined devices, meeting the security requirements.
- C. Incorrect.
Option 3 is incorrect because pass-through authentication for point-to-site does not leverage Azure AD or require domain-joined devices. This approach would not meet the requirement to enforce device compliance or Azure AD–specific authentication.
- D. Incorrect.
Option 4 is incorrect because using ExpressRoute addresses private connectivity but does not inherently provide user VPN access or Azure AD enforcement for domain-joined devices in a point-to-site scenario. Additionally, the requirement is specifically for a VPN solution rather than dedicated private circuit only.