AZ-700 Question 131
Single answerYou are a network engineer at a company that has provisioned an ExpressRoute circuit with Azure private peering to connect the on-premises data center to multiple Azure VNets. Although the circuit status shows as Enabled and Provisioned, none of the on-premises servers can reach the private IP addresses of the Azure VMs. Which of the following actions should you take next to enable end-to-end connectivity over the private peering?
- A
Configure each Azure VM with a public IP address to allow inbound traffic from the on-premises environment
- B
Establish a BGP session on the on-premises router for the private peering VLAN and advertise the on-premises IP address ranges
- C
Enable Network Security Group (NSG) rules for inbound Internet traffic to allow connectivity to Azure VNets
- D
Deploy a separate ExpressRoute gateway resource for each Azure VNet in the subscription
Show answer and explanation
Correct answer: B
Explanation
To enable Azure private peering, you must configure BGP sessions on each end of the ExpressRoute private peering connection and advertise your on-premises IP prefixes so Azure knows how to route traffic back to your data center. Only the on-premises router needs to establish the correct VLAN and IP addressing for the private peering. For more information, refer to Microsoft� official documentation on configuring ExpressRoute private peering (https://learn.microsoft.com/azure/expressroute/expressroute-howto-routing#private-peering).
- A. Incorrect.
Incorrect. Assigning public IPs to your Azure VMs does not solve the underlying private connectivity issue. Azure private peering is intended for using private IP addresses and routing them via ExpressRoute, so this step is unnecessary for private access.
- B. Correct.
Correct. For Azure private peering to work, you must configure a BGP session with the correct VLAN ID and IP addressing on the on-premises router. You then advertise your on-premises IP address ranges via BGP so that Azure can route return traffic correctly to your data center.
- C. Incorrect.
Incorrect. Enabling NSG rules for inbound Internet traffic will not fix the private routing issue. NSGs do not control BGP routing or ExpressRoute path configurations. They only filter traffic at the subnet or VM level within Azure and primarily relate to security controls, not establishing private connectivity.
- D. Incorrect.
Incorrect. You do not need a separate ExpressRoute gateway resource for each VNet if they are all connected via the same ExpressRoute circuit and private peering. A single ExpressRoute gateway can serve multiple VNets using VNet peering or gateway transit, depending on the architecture.