AZ-700 Question 103
Single answerYour company� on-premises network team wants to implement a Site-to-Site VPN between the corporate data center and an Azure VNet. They require dynamic routing (BGP) to handle multiple subnets and plan to configure active-active VPN connections for redundancy. Which VPN tunnel type should you select to meet all these requirements?
- A
Policy-based VPN
- B
Route-based VPN
- C
ExpressRoute Private Peering
- D
Point-to-Site (Client VPN) using SSTP
Show answer and explanation
Correct answer: B
Explanation
In Azure, a route-based VPN is required when you need dynamic routing using BGP, multi-site connectivity, or active-active configurations for redundancy. Policy-based VPNs are limited to static routes and do not support BGP, making them unsuitable for more advanced or scalable scenarios. For more details, refer to the official Microsoft documentation on VPN Gateway configurations for route-based and policy-based tunnels.
- A. Incorrect.
Option 1 (Policy-based VPN): Incorrect. While policy-based VPNs can secure traffic based on specific IP address pairs (static routes), they do not support BGP or active-active configurations with multiple tunnels. Policy-based VPNs generally work well for smaller, fixed traffic patterns but are not suitable for dynamic routing requirements.
- B. Correct.
Option 2 (Route-based VPN): Correct. Route-based VPNs use any-to-any (wildcard) traffic selectors and can integrate with BGP for dynamic routing. They also support active-active configurations, enabling high availability and scalability when multiple tunnels are needed.
- C. Incorrect.
Option 3 (ExpressRoute Private Peering): Incorrect. ExpressRoute is a dedicated circuit for private connectivity to Azure, not a Site-to-Site VPN tunnel type. While ExpressRoute can offer high throughput and reliability, it does not replace the need for a VPN tunnel solution in this scenario.
- D. Incorrect.
Option 4 (Point-to-Site (Client VPN) using SSTP): Incorrect. Point-to-Site connections are suited for individual clients or remote users to connect securely to Azure, not for corporate Site-to-Site scenarios that require dynamic routing and redundancy.