AZ-700 Question 136
Select 2You are designing a hybrid Azure solution that requires private connectivity from your on-premises data center to a virtual network (VNet) in Azure via an ExpressRoute circuit. You have already created the VNet named 'ProdVNet' in the East US region. Which two of the following steps must you perform to successfully create and configure your ExpressRoute gateway in Azure?
- A
Create a subnet named 'GatewaySubnet' in ProdVNet, ensuring it has sufficient addresses (e.g., /27 or larger).
- B
Set the gateway type to 'VPN' first, then modify the same gateway to use 'ExpressRoute' after creation.
- C
Choose the ExpressRoute gateway type and select an appropriate SKU (for example, Standard or UltraPerformance).
- D
Enable site-to-site VPN on the ExpressRoute circuit before the gateway can route private traffic.
Show answer and explanation
Correct answers: A, C
Explanation
When creating an ExpressRoute gateway, you must first have a properly sized GatewaySubnet (e.g., /27 or larger) in your Azure virtual network. Next, you create the gateway with the 'ExpressRoute' gateway type and select an appropriate SKU. You cannot convert a VPN gateway to an ExpressRoute gateway after it is created; a new gateway deployment is required if you initially choose the wrong gateway type. Refer to Microsoft documentation for more details on configuring and deploying ExpressRoute gateways (https://learn.microsoft.com/azure/expressroute/howto-expressroute-classic to see recommended procedures and best practices).
- A. Correct.
Correct. An ExpressRoute gateway requires a GatewaySubnet in the virtual network. The gateway subnet must have a suitable address range (e.g., /27 or larger) for reliability and future scaling.
- B. Incorrect.
Incorrect. You cannot change a Virtual Network Gateway from VPN to ExpressRoute after creation. You must specify the gateway type as 'ExpressRoute' when you create it.
- C. Correct.
Correct. When creating the Virtual Network Gateway for ExpressRoute, you must specify the type as 'ExpressRoute' and select a corresponding SKU (such as Standard, HighPerformance, or UltraPerformance), depending on bandwidth requirements.
- D. Incorrect.
Incorrect. Site-to-site VPN is a separate connectivity option and does not need to be enabled on the ExpressRoute circuit for private traffic to route to Azure. ExpressRoute uses a dedicated private connection and does not require a VPN tunnel to function.