AZ-700 Question 153
Single answerYou have an existing Virtual WAN in Azure and must create a new hub named 'HubEastUS' in the East US region to provide site-to-site VPN connectivity from your on-premises environment to multiple VNets. Which of the following actions is required to properly create and configure this new Virtual WAN hub with site-to-site VPN gateway support?
- A
Specify a unique address space for the hub, select Site-to-site (VPN) gateway under Hub type, and choose the East US region.
- B
Assign a public IP address to the hub� default route table for the site-to-site VPN connections.
- C
Enable only an ExpressRoute gateway on the hub, because it automatically supports VPN traffic.
- D
Configure a DNS server setting directly within the Virtual WAN hub to route on-premises traffic.
Show answer and explanation
Correct answer: A
Explanation
To create a new hub in a Virtual WAN with site-to-site VPN connectivity, you must define a unique address space for the hub and enable the site-to-site (VPN) gateway under the hub configuration. This ensures traffic can flow between on-premises resources and Azure VNets through the VPN gateway. For more details, refer to Microsoft documentation on creating and configuring hubs in Virtual WAN: https://learn.microsoft.com/azure/virtual-wan/virtual-wan-create-hub.
- A. Correct.
Correct. When creating a new Virtual WAN hub to support site-to-site VPN connections, you must specify an address space for the hub (distinct from address spaces in connected VNets) and enable the 'Site-to-site (VPN)' gateway in the Hub configuration. You must also ensure the hub is deployed in the correct region�in this case, East US.
- B. Incorrect.
Incorrect. You do not assign a public IP address to the default route table in a Virtual WAN hub. The hub� VPN gateway is automatically assigned a public IP as part of its gateway configuration. There is no manual assignment of public IPs directly to the route table.
- C. Incorrect.
Incorrect. ExpressRoute and VPN are separate gateway types in Virtual WAN. Enabling ExpressRoute alone does not automatically provide VPN connectivity. You must specifically enable the site-to-site VPN gateway to support on-premises VPN connections.
- D. Incorrect.
Incorrect. While DNS settings can be configured for name resolution, they are not required to establish site-to-site VPN connectivity. Configuring a DNS server within the Virtual WAN hub does not replace the need to enable the site-to-site gateway and specify an address space for the hub.