AZ-700 Question 128
Select 3Contoso has two on-premises locations: a primary data center in Dallas and a branch office in Berlin. Each location is connected to Azure via its own ExpressRoute circuit. The company wants to achieve three key objectives: (1) allow direct, private connectivity between its on-premises networks without sending traffic over the internet, (2) reduce latency by bypassing the gateway for data plane traffic to Azure VMs, and (3) establish a dedicated port with high bandwidth capacity for mission-critical workloads. Which combination of ExpressRoute features or services should you implement to meet these requirements? (Choose three.)
- A
ExpressRoute Global Reach
- B
ExpressRoute FastPath
- C
ExpressRoute Direct
- D
VPN Gateway with forced tunneling
- E
Azure Firewall
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the stated objectives, Contoso should use ExpressRoute Global Reach to create private connectivity between its two on-premises locations, ExpressRoute FastPath to reduce latency by bypassing the gateway for data plane traffic, and ExpressRoute Direct for high-bandwidth, dedicated physical ports. For more details, refer to official Microsoft documentation on ExpressRoute features: https://learn.microsoft.com/en-us/azure/expressroute/.
- A. Correct.
Option A: ExpressRoute Global Reach. CORRECT. Global Reach allows you to connect different on-premises locations through the Microsoft network when you have multiple ExpressRoute circuits. This satisfies the requirement of enabling the company's Dallas and Berlin sites to exchange data privately without sending traffic over the public internet.
- B. Correct.
Option B: ExpressRoute FastPath. CORRECT. FastPath reduces latency by allowing data plane traffic from on-premises to bypass the ExpressRoute Gateway when communicating with Azure virtual machines. This helps fulfill the company's requirement to shorten the data path and improve performance to Azure VMs.
- C. Correct.
Option C: ExpressRoute Direct. CORRECT. ExpressRoute Direct provides dedicated physical ports at Microsoft edge locations, supporting higher bandwidth options (for instance, 10 Gbps or 100 Gbps). This meets the requirement for mission-critical workloads that need large capacity, guaranteed performance, and more direct control over connectivity.
- D. Incorrect.
Option D: VPN Gateway with forced tunneling. INCORRECT. While VPN Gateways can route traffic securely over IPsec tunnels, forcing traffic to the on-premises environment is not aligned with the company's objective to leverage private connections between their on-premises sites via ExpressRoute. It also doesn't address the high-bandwidth requirement as effectively as ExpressRoute Direct.
- E. Incorrect.
Option E: Azure Firewall. INCORRECT. Azure Firewall is a security service that provides network and application-level protection, not a solution for interconnecting multiple on-premises sites or reducing latency to Azure VMs. It does not fulfill the requirements for private connectivity between on-prem sites or the need for dedicated ports.