AZ-700 Question 142
Single answerYour company has an existing ExpressRoute circuit established with private peering to connect the on-premises data center to Azure. Due to new compliance requirements, your security team mandates that all data traversing this circuit must be encrypted in transit. However, your ExpressRoute provider does not support MACsec. Which solution should you implement to achieve in-transit encryption with minimal disruption to your existing network setup?
- A
Use a Site-to-Site VPN tunnel over the existing ExpressRoute circuit by enabling IPsec on both ends
- B
Enable end-to-end encryption in the ExpressRoute configuration in the Azure portal
- C
Switch to an ExpressRoute Global Reach configuration that supports MACsec encryption by default
- D
Disable private peering and rely on public peering over TLS connections for encrypted traffic
Show answer and explanation
Correct answer: A
Explanation
When your ExpressRoute provider does not support MACsec, you can encrypt traffic in transit by layering IPsec on top of the existing private circuit. Azure VPN Gateway or suitable on-premises devices can establish a Site-to-Site VPN tunnel over ExpressRoute for secure communication. Refer to Azure documentation on 'Using IPsec with ExpressRoute' for best practices and detailed steps.
- A. Correct.
Correct. Creating an IPsec-based Site-to-Site VPN tunnel over your existing ExpressRoute circuit is a common way to add encryption in scenarios where the provider does not support MACsec. You use an Azure VPN Gateway or a compatible on-premises device to encapsulate the traffic and secure it with IPsec. This integrates well with existing network infrastructures and meets compliance without requiring a change of provider or circuit type.
- B. Incorrect.
Incorrect. ExpressRoute circuits do not provide a toggle or built-in mechanism in the Azure portal to enable encryption at the click of a button. While ExpressRoute secures traffic by providing a private connection, it does not perform inherent encryption unless MACsec is supported by the provider. Additional overlays, such as an IPsec tunnel, are required for encryption.
- C. Incorrect.
Incorrect. ExpressRoute Global Reach connects your different on-premises sites via Microsoft� network, but it does not inherently offer MACsec encryption by default. MACsec support depends on your service provider and the physical infrastructure, not solely on the Global Reach feature.
- D. Incorrect.
Incorrect. Disabling private peering would force you to use public peering or the internet, potentially adding complexity or reducing performance. Furthermore, relying solely on TLS for applications is not a comprehensive approach to network encryption for all workloads, and it does not meet the stated requirement of encrypting all traffic in transit at the network level.