AZ-700 Question 91
Select 2You manage a route-based site-to-site VPN connecting your on-premises network to Azure. Your security team requires stronger encryption, so you create a custom IPsec/IKE policy using AES256 for encryption, SHA256 for integrity, and Diffie-Hellman Group 14 for PFS. You want to apply this policy to your existing connection in Azure. Which two steps must you complete to fully implement this custom IPsec/IKE policy?
- A
Attach the custom IPsec/IKE policy to the local network gateway resource so the policy applies automatically.
- B
Turn on the 'UsePolicyBasedTrafficSelectors' setting to enable custom IPsec/IKE policy parameters.
- C
Change the VPN type from route-based to policy-based to enforce the new IPsec/IKE policy settings.
- D
Assign the custom IPsec/IKE policy to the connection resource using Azure PowerShell or CLI commands.
- E
Validate the connection by running a test or checking the negotiated security associations (SAs) after applying the policy.
Show answer and explanation
Correct answers: D, E
Explanation
In Azure, custom IPsec/IKE policies are associated directly with the connection resource, not the local network gateway. After creating and assigning the policy, it is best practice to test the connection and confirm that your specified algorithms and Diffie-Hellman group are correctly negotiated. Microsoft� documentation (e.g. 'Configure IPsec/IKE policy for S2S VPN or VNet-to-VNet connections' in Azure) outlines that route-based VPNs support these settings and that verification via Azure PowerShell/CLI commands or the Azure portal is essential to ensure correct implementation.
- A. Incorrect.
Option 1 is incorrect because attaching the IPsec/IKE policy to the local network gateway does not apply the policy at the tunnel level. In Azure, you assign the policy to the connection object itself.
- B. Incorrect.
Option 2 is incorrect because 'UsePolicyBasedTrafficSelectors' is generally set to true only if you need policy-based VPN compatibility. For a route-based VPN with a custom IPsec/IKE policy, this is typically not required.
- C. Incorrect.
Option 3 is incorrect because you do not need to switch from route-based to policy-based. Route-based connections support custom IPsec/IKE policies and are the recommended VPN type in most Azure scenarios.
- D. Correct.
Option 4 is correct because Azure requires you to apply the IPsec/IKE policy directly to the VPN connection resource (via PowerShell, Azure CLI, or other management tools). This ensures the policy parameters (AES256, SHA256, and DH Group 14) are enforced for the tunnel.
- E. Correct.
Option 5 is correct because you should verify the connection after applying the custom IPsec/IKE policy. Testing confirms that the negotiated security associations match your specified encryption, integrity, and key exchange settings.