AZ-700 Question 87
Single answerYour company wants to connect multiple branch offices to Azure via site-to-site VPN connections. Each branch office uses dynamic routing protocols and may require frequent additions or modifications to on-premises subnets. Which type of VPN solution should be used to meet these requirements?
- A
Route-based VPN connection
- B
Policy-based VPN connection
- C
ExpressRoute circuit
- D
Point-to-Site VPN connection
Show answer and explanation
Correct answer: A
Explanation
In Azure, policy-based VPN connections are typically used for simpler, static routing environments. Route-based VPN connections, in contrast, leverage IP routing tables for secure tunneling and are essential if you need features like BGP or anticipate changes to subnets. According to Microsoft� documentation (https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings), route-based VPNs provide greater flexibility and support for dynamic routing configurations.
- A. Correct.
This is correct because route-based VPNs rely on routing tables to manage tunnels and support dynamic routing (e.g., BGP). They are best suited for environments where subnets might change often and where advanced routing features are required.
- B. Incorrect.
Policy-based VPNs rely on static IPsec policies defining specific networks on each side of the tunnel. While they can be appropriate for simple, fixed connections, they are not well-suited for dynamic routing or frequently changing subnet requirements.
- C. Incorrect.
ExpressRoute is a private, dedicated connection that does not rely on a VPN over the public Internet. While it is fast and secure for hybrid connectivity, it does not match the scenario� requirement for a VPN-based solution.
- D. Incorrect.
A Point-to-Site VPN is meant primarily for individual client devices connecting into Azure, not for an entire on-premises network with dynamic routing requirements.