AZ-700 Question 137
Select 2You have an existing ExpressRoute circuit with Azure private peering in place. You want to connect a new virtual network (VNet) to this same circuit to establish private connectivity from your on-premises environment to the VNet. You have already created a gateway subnet (e.g., /27) within the VNet. Which two actions should you take in Azure to finalize the connection to the ExpressRoute circuit?
- A
Deploy a Virtual Network Gateway of type 'ExpressRoute' in the VNet and associate it with the gateway subnet.
- B
Obtain and use the authorization key from the ExpressRoute circuit to create a connection resource linking the VNet gateway to the circuit.
- C
Create user-defined routes (UDRs) in each subnet of the VNet to forward traffic to the on-premises IP range as the next hop.
- D
Enable forced tunneling in the VNet by advertising a default route from the on-premises BGP router.
Show answer and explanation
Correct answers: A, B
Explanation
To connect a VNet to an existing ExpressRoute circuit, you must deploy a Virtual Network Gateway of type 'ExpressRoute' in the VNet� gateway subnet. Then, you create a connection resource using the authorized key from the circuit to securely link the VNet gateway to the ExpressRoute circuit. User-defined routes and forced tunneling are advanced configurations that may be applied based on specific routing or security requirements, but they are not prerequisites for basic ExpressRoute connectivity. For more details, see Azure documentation on 'Create and modify an ExpressRoute circuit'.
- A. Correct.
Correct. For ExpressRoute connectivity, you must create a dedicated Virtual Network Gateway of type 'ExpressRoute' and place it in the gateway subnet within your VNet. This gateway is responsible for establishing the IPsec or BGP session towards the ExpressRoute circuit (through Azure� backbone).
- B. Correct.
Correct. After deploying the ExpressRoute gateway, you need to use the authorization key (provided by the circuit owner or from your own circuit if you have the necessary permissions) to link the VNet gateway to the existing ExpressRoute circuit. This step creates the connection resource that enables end-to-end private connectivity between on premises and Azure.
- C. Incorrect.
Incorrect. In most cases, you do not need to set up custom user-defined routes (UDRs) for basic ExpressRoute connectivity. By default, ExpressRoute private peering automatically handles route propagation to your VNet. UDRs might be used for advanced routing scenarios, but they are not required to establish the core connection.
- D. Incorrect.
Incorrect. Enabling forced tunneling by advertising a default route from on-premises is an optional design choice, typically used for directing all internet-bound traffic through on-premises security appliances. It is not mandatory for standard ExpressRoute connectivity. You only need it if your organization specifically requires all outbound traffic to route through on-premises.