AZ-700 Question 99
Select 2Your company wants to implement a point-to-site VPN for remote employees to securely connect to an Azure virtual network. They require multi-factor authentication (MFA) integrated with Azure Active Directory. You already have a Virtual Network Gateway provisioned in Azure. Which two actions should you take to configure Azure AD-based authentication for the point-to-site VPN? (Select two.)
- A
Configure the tunnel type to OpenVPN on the Virtual Network Gateway
- B
Upload and configure a root certificate for client certificate-based authentication
- C
Assign the Network Contributor role to each Azure AD user requiring VPN access
- D
Specify the Azure AD tenant information (Tenant ID, Issuer, Audience) on the VPN gateway configuration
Show answer and explanation
Correct answers: A, D
Explanation
To enable Azure AD MFA with point-to-site VPN connections, you must use the OpenVPN tunnel type and configure the Azure AD tenant settings on the VPN Gateway. Client certificates or role assignments are not required when leveraging Azure AD as the identity provider. For more details, refer to Microsoft� documentation on configuring Azure Active Directory authentication for point-to-site VPN connections: https://learn.microsoft.com/azure/vpn-gateway/openvpn-azure-ad-tenant
- A. Correct.
Correct. Azure AD-based MFA authentication for point-to-site VPN requires OpenVPN as the tunnel type. IKEv2 by itself does not support Azure AD integration with MFA.
- B. Incorrect.
Incorrect. Uploading a root certificate is necessary when using certificate-based authentication. With Azure AD-based authentication, the focus is on Azure AD tenant configuration, not certificate management.
- C. Incorrect.
Incorrect. While roles can manage access to network resources, assigning the Network Contributor role to each user does not enable Azure AD MFA for the VPN. Azure AD-based authentication does not rely on this role-based approach for P2S connectivity.
- D. Correct.
Correct. For Azure AD-based authentication, you must provide details such as the Azure AD Tenant ID, Issuer, and Audience in the gateway configuration to properly authenticate and enable MFA.