AZ-700 Question 130
Single answerYou manage networking for a company that has just deployed multiple virtual machines in an Azure VNet and also relies heavily on Office 365 services. They plan to use ExpressRoute to connect their on-premises data center to Azure. The requirement is to establish private connectivity to the VMs in the VNet and also to Office 365, without routing either set of traffic over the public internet. Which ExpressRoute peering configuration should you implement?
- A
Configure Azure Private Peering only
- B
Configure Microsoft Peering only
- C
Configure both Azure Private Peering and Microsoft Peering on the same ExpressRoute circuit
- D
Use default routing with forced tunneling for Office 365 traffic on Azure Private Peering
Show answer and explanation
Correct answer: C
Explanation
When you need to connect on-premises workloads to both Azure VNets (using private IP addresses) and Microsoft SaaS services such as Office 365, you should configure Azure Private Peering for the virtual networks and Microsoft Peering for the Office 365 traffic. This approach follows Microsoft� best practices and ensures that traffic for each set of services is routed optimally. You can reference Microsoft documentation on ExpressRoute circuit peerings (https://learn.microsoft.com/azure/expressroute/expressroute-circuit-peerings) for detailed guidance and supported scenarios.
- A. Incorrect.
Azure Private Peering alone provides a private connection to Azure VNets for your virtual machines and services but does not offer direct private access to Microsoft SaaS services such as Office 365.
- B. Incorrect.
Microsoft Peering alone is designed to provide direct access to Microsoft SaaS and PaaS services (e.g., Office 365, Dynamics 365) but won't provide private connectivity to your Azure VNets.
- C. Correct.
You must configure both Azure Private Peering (to reach your private IP resources in Azure VNets) and Microsoft Peering (to reach Office 365 services) on your ExpressRoute circuit if you want private connectivity for both scenarios.
- D. Incorrect.
Forced tunneling through Azure Private Peering does not automatically provide direct private connectivity to Office 365, which specifically requires Microsoft Peering for support and proper routing.