AZ-500 Question 66
Select 2A healthcare company is using an existing Standard ExpressRoute circuit for connectivity between its on-premises data center and Azure. Due to regulatory requirements, they must ensure data in transit is always encrypted. The team is also considering an upgrade to ExpressRoute Direct in the near future to have a dedicated physical interface. Which of the following approaches can provide encryption over ExpressRoute connections in this scenario?
- A
Configure an IPsec Site-to-Site (S2S) VPN tunnel on top of the current Standard ExpressRoute circuit
- B
Enable MACsec encryption on the provider's edge hardware for the Standard ExpressRoute circuit
- C
Enable MACsec encryption on an ExpressRoute Direct circuit
- D
Activate the “Encryption in Transit” toggle in the Azure portal for the existing ExpressRoute Gateway
Show answer and explanation
Correct answers: A, C
Explanation
ExpressRoute by itself does not natively encrypt traffic. To achieve encryption in transit, you can layer an IPsec VPN tunnel over Standard ExpressRoute to protect data at the network layer or use MACsec on ExpressRoute Direct, which supports hardware-based encryption on dedicated physical ports. Refer to Microsoft’s official documentation for ExpressRoute encryption best practices: https://learn.microsoft.com/azure/expressroute/expressroute-about-encryption.
- A. Correct.
Option 1 is correct. An IPsec tunnel layered on top of ExpressRoute is a common method to add encryption in transit for Standard ExpressRoute circuits. The data passes privately via ExpressRoute, and IPsec provides encryption end-to-end.
- B. Incorrect.
Option 2 is incorrect. MACsec (media access control security) for ExpressRoute is only available with ExpressRoute Direct, not with a Standard ExpressRoute circuit. Standard ExpressRoute circuits do not support MACsec on the edge hardware.
- C. Correct.
Option 3 is correct. ExpressRoute Direct supports MACsec at Layer 2 on dedicated physical ports. This can encrypt data in transit at the physical layer, meeting compliance requirements for organizations that need dedicated circuits and hardware-based encryption.
- D. Incorrect.
Option 4 is incorrect. There is no simple 'Encryption in Transit' toggle for ExpressRoute in the Azure portal. ExpressRoute itself does not natively encrypt traffic. Encryption must be provided by either an IPsec tunnel or MACsec (with ExpressRoute Direct).