AZ-700 Question 141
Single answerYou manage the on-premises network for a financial institution that connects to multiple Azure VNets via ExpressRoute. A new compliance requirement mandates that any data traversing your dedicated circuit must be fully encrypted in transit. Which solution should you implement to meet the requirement?
- A
Enable TLS/SSL for the applications hosted in Azure to encrypt all communication data automatically
- B
Use an IPSec VPN tunnel layered on top of your existing ExpressRoute circuit
- C
Rely on Azure-managed encryption features, as ExpressRoute transmissions are inherently encrypted
- D
Configure Azure Virtual WAN to encrypt traffic by default without additional setup
Show answer and explanation
Correct answer: B
Explanation
By default, ExpressRoute provides a private connection but not full encryption in transit. Many organizations overlay an IPSec VPN tunnel on top of ExpressRoute to secure all traffic. According to Microsoft documentation on 'About ExpressRoute Encryption', building an IPSec tunnel ensures compliance and privacy for all protocols and data types carried over the circuit.
- A. Incorrect.
Option 1: Enabling TLS/SSL secures application-layer traffic (e.g., HTTPS) but does not guarantee encryption for all protocols or data flows across ExpressRoute. Some traffic types (like certain database connections or file transfers) may remain unencrypted if they do not use TLS/SSL.
- B. Correct.
Option 2: Using an IPSec VPN tunnel in combination with ExpressRoute is a proven way to encrypt all data traversing the link. The VPN tunnel encapsulates and encrypts traffic before sending it over the dedicated circuit, meeting end-to-end encryption requirements.
- C. Incorrect.
Option 3: While Azure offers robust encryption at rest and for specific services in transit (e.g., Azure Storage), ExpressRoute circuits themselves do not automatically encrypt data by default. Additional measures are necessary to ensure full data-in-transit encryption.
- D. Incorrect.
Option 4: Azure Virtual WAN does support VPN and secure connectivity options, but it does not encrypt traffic �by default� without additional configuration. You still need to configure a secure IPSec tunnel or similar encryption method.