AZ-700 Question 90
Select 2You are configuring a site-to-site VPN connection from your Azure VNet to an on-premises location. The on-premises VPN device has the public IP address 203.0.113.10, and the on-premises network uses the IP range 10.10.0.0/16. You need to create and configure a local network gateway in Azure so that traffic from Azure can reach the on-premises network via this device. Which two actions must you take when creating the local network gateway to ensure the connection can be established?
- A
Specify the public IP address 203.0.113.10 in the GatewayIpAddress property of the local network gateway
- B
Enable BGP in the local network gateway to dynamically advertise routes
- C
List the on-premises address space 10.10.0.0/16 under the Address Space setting
- D
Assign the on-premises DNS servers directly in the local network gateway properties
Show answer and explanation
Correct answers: A, C
Explanation
When creating a local network gateway, you generally must provide the public IP address of the on-premises VPN device (the GatewayIpAddress) and the on-premises address ranges to be routed. Specifying these ensures that Azure knows how to direct VPN traffic to the correct on-premises endpoint and which subnets lie behind it. BGP is only necessary if dynamic route exchange is required. For more information, refer to the official Microsoft documentation: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal.
- A. Correct.
Correct. Providing the public IP address of the on-premises VPN device in the local network gateway (GatewayIpAddress) is required to correctly route VPN traffic to the right endpoint.
- B. Incorrect.
Incorrect. Enabling BGP is optional and only needed if you plan to dynamically exchange routes with the on-premises device. It is not strictly required for a basic site-to-site VPN setup.
- C. Correct.
Correct. The local network gateway needs to know which on-premises networks should be routed through the VPN tunnel. Specifying the on-premises address space (10.10.0.0/16) ensures correct routing.
- D. Incorrect.
Incorrect. Custom DNS server settings do not go into the local network gateway properties. If you need to use custom DNS in your VNet, you configure it at the virtual network level, not on the local network gateway.