AZ-700 Question 115
Select 3A company plans to host an Always On VPN solution in Azure to provide secure remote access for their traveling employees. You are tasked with confirming all necessary Azure requirements are in place. Which of the following statements describe required Azure configurations for Always On VPN? (Choose three.)
- A
Deploy a route-based VPN gateway in Azure that supports IKEv2.
- B
Use a policy-based VPN gateway if RADIUS authentication is configured.
- C
Assign a publicly routable IP address to the Azure VPN gateway.
- D
Enable Border Gateway Protocol (BGP) on the Azure VPN gateway.
- E
Open inbound UDP ports 500 and 4500 on the Network Security Group to support IKEv2 and IPsec traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
Always On VPN deployments in Azure require a route-based VPN gateway configured for IKEv2 with a public IP address, and inbound access for ports 500 and 4500 to handle the IKEv2/IPsec handshake. Policy-based VPN gateways do not support these requirements. For more information, refer to Microsoft documentation on Always On VPN prerequisites and Azure VPN gateway configuration.
- A. Correct.
Option 1 is correct. Always On VPN requires a route-based VPN gateway that supports IKEv2 to establish secure tunnels. Policy-based gateways have limited functionality and do not adequately support IKEv2-based tunnels.
- B. Incorrect.
Option 2 is incorrect. Policy-based VPN gateways are not recommended for Always On VPN because they do not support the dynamic routing or IKEv2 configurations that Always On VPN needs.
- C. Correct.
Option 3 is correct. The Azure VPN gateway must have a public IP address to accept inbound VPN connections from remote clients. This is necessary for external user devices to initiate the VPN tunnel.
- D. Incorrect.
Option 4 is incorrect. Enabling BGP is optional and depends on advanced routing scenarios. It is not a mandatory requirement for Always On VPN functionality by default.
- E. Correct.
Option 5 is correct. UDP ports 500 and 4500 must be allowed inbound in the Network Security Group (NSG) for IKEv2 and IPsec traffic to successfully pass through the Azure network.