AZ-700 Question 80
Select 2Your company has an on-premises data center that must connect securely to an Azure Virtual Network (VNet) using a site-to-site VPN. You need dynamic routing for multiple on-premises subnets and anticipate adding BGP in the future. You set up an Azure VPN Gateway with the VPN type set to Route-based. However, the connection fails to establish, and your on-premises firewall's logs show that it cannot handle policy-based VPNs. After reviewing Azure, you suspect the local network gateway is missing some on-premises subnet definitions. Which two actions should you take to create a functional site-to-site VPN connection with dynamic routing in this scenario?
- A
Switch the Azure VPN Gateway to a policy-based VPN type to match your firewall capabilities.
- B
Ensure your Azure VPN Gateway SKU is compatible with Route-based VPN and reconfigure the on-premises firewall to support Route-based VPN.
- C
Limit the on-premises address space in the local network gateway to reduce subnet overlaps in Azure.
- D
Add the missing on-premises subnets to the local network gateway configuration in Azure.
- E
Set the Azure VPN Gateway to use ExpressRoute for dynamic routing to the on-premises environment.
Show answer and explanation
Correct answers: B, D
Explanation
For a site-to-site VPN with dynamic routing in Azure, you need a Route-based VPN Gateway (not policy-based) and accurate local network gateway configurations reflecting all on-premises subnets. Ensure your firewall supports route-based configurations (IKEv2). Missing or incorrect subnet entries in the local network gateway commonly cause connection failures. Refer to Microsoft documentation (e.g., https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal) for details on site-to-site VPN setup, including local network gateway configurations and appropriate VPN Gateway SKUs.
- A. Incorrect.
Option 1 is incorrect. You need dynamic routing and your logs show the on-premises firewall cannot handle policy-based VPN. Policy-based VPN would not support BGP or multiple address spaces easily. Switching to a policy-based configuration is contrary to your future BGP requirement and your firewall's logs.
- B. Correct.
Option 2 is correct. Route-based VPN is required for dynamic routing and BGP. You must confirm that both your Azure VPN Gateway SKU (e.g., VpnGw1 or higher) and your firewall support IKEv2 and Route-based VPN. If needed, update the firewall firmware or settings to ensure it uses a route-based configuration.
- C. Incorrect.
Option 3 is incorrect. Simply limiting the on-premises address space in the local network gateway does not solve your issue unless you correctly match the actual subnets. Reducing subnet overlaps is valid only if there is a genuine conflict, not just missing definitions.
- D. Correct.
Option 4 is correct. You must add all necessary and accurate on-premises subnets to the local network gateway so that Azure can route traffic correctly. Missing subnet definitions will prevent the tunnel from establishing or routing traffic properly.
- E. Incorrect.
Option 5 is incorrect. ExpressRoute is a dedicated private connection that is different from a site-to-site VPN. You cannot just switch to ExpressRoute for dynamic routing without provisioning a separate circuit and configuring ExpressRoute-specific connections.