AZ-700 Question 79
Single answerYour company is expanding to a new location and needs to establish dynamic routing between the on-premises network and an Azure VNet using BGP. You have been asked to configure a site-to-site VPN connection to support BGP-based route exchanges. Which configuration should you choose for the Azure VPN gateway?
- A
Implement a Route-Based VPN in Azure, then enable BGP on both the Azure VPN gateway and the on-premises router
- B
Implement a Policy-Based VPN in Azure, then enable BGP on both the Azure VPN gateway and the on-premises router
- C
Deploy ExpressRoute for the new location and configure a Local Network Gateway with BGP
- D
Use an OpenVPN protocol gateway in Azure to support dynamic routing via BGP
Show answer and explanation
Correct answer: A
Explanation
When designing a site-to-site VPN that supports BGP in Azure, you must choose a Route-Based VPN. This type of gateway can establish dynamic routing sessions with your on-premises router via BGP. Policy-Based VPNs do not support BGP, and ExpressRoute or OpenVPN options are not relevant when the requirement is specifically for IPsec-based site-to-site connectivity with dynamic routing. For more information, refer to Microsoft documentation on 'Configure BGP on Azure VPN Gateways.'
- A. Correct.
Correct: To support BGP route exchanges over a site-to-site VPN, you must use a Route-Based VPN in Azure. Route-Based gateways allow dynamic routing protocols like BGP to advertise and learn routes between Azure and on-premises networks.
- B. Incorrect.
Incorrect: Policy-Based VPN gateways do not support dynamic routing protocols such as BGP. They rely on static address pairs for encryption domains.
- C. Incorrect.
Incorrect: ExpressRoute is a dedicated private connection that generally does not use IPsec VPN tunnels for connectivity. It is a different connectivity method and not applicable here if you explicitly need a site-to-site VPN with BGP over IPsec.
- D. Incorrect.
Incorrect: OpenVPN protocol is typically used for Point-to-Site connections or client-based VPN solutions within Azure, not for site-to-site BGP configurations.