AZ-700 Question 81
Select 2Your company needs to set up a site-to-site VPN connection between its on-premises data center and Azure with minimal downtime. The network design must automatically fail over in the event one of the VPN endpoints becomes unavailable. Which two approaches should you implement to achieve a highly available configuration?
- A
Deploy a zone-redundant VPN gateway in Active-Active mode for your Azure virtual network
- B
Implement BGP with separate on-premises devices connecting to each public IP address on the Azure VPN gateway
- C
Configure Force Tunneling to redirect all outbound Internet traffic back to on-premises
- D
Use a single on-premises VPN device with a PolicyBased VPN type
Show answer and explanation
Correct answers: A, B
Explanation
To achieve a highly available site-to-site VPN in Azure, you must eliminate single points of failure and leverage multiple tunnels. Deploying an Active-Active, zone-redundant VPN gateway and enabling BGP-based routing with multiple on-premises devices are recognized best practices. These designs are outlined in Microsoft's documentation on VPN Gateway high availability: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-highlyavailable.
- A. Correct.
Option 1: CORRECT. A zone-redundant VPN gateway in Active-Active mode provides high availability by deploying gateway instances across different availability zones and enabling traffic across multiple tunnels. This design ensures continuity even if one Azure gateway instance fails.
- B. Correct.
Option 2: CORRECT. Using BGP with multiple on-premises devices connected to each VPN gateway IP allows for dynamic routing and redundancy. If one tunnel goes down, routing protocols automatically reroute traffic to another healthy path, improving resiliency.
- C. Incorrect.
Option 3: INCORRECT. Force Tunneling sends all outbound Internet traffic back to on-premises. While it can be useful for compliance scenarios, it does not directly enhance the high availability of the VPN connection and can add unnecessary complexity.
- D. Incorrect.
Option 4: INCORRECT. A single on-premises VPN device with a PolicyBased VPN type creates a single point of failure and does not support active-active scenarios or BGP for failover. This configuration limits your ability to achieve automatic resiliency.