Design, implement, and manage connectivity services

Contoso has an ExpressRoute circuit with private peering connecting their on-premises datacenter to an Azure virtual network. A new compliance requirement mandates that all traffic traversing the ExpressRoute connection between on-premises and Azure must be encrypted, while continuing to use the existing ExpressRoute circuit as the transport path. Which solution meets this requirement with the least additional cost and complexity?

Your company is deploying ExpressRoute Direct to connect a large data center directly into the Microsoft backbone. The workload requires guaranteed dedicated capacity, and the network team wants to provision multiple ExpressRoute circuits on the same physical ports over time. Which port pair bandwidth options are supported when provisioning ExpressRoute Direct?

Contoso has an ExpressRoute circuit with private peering connected to a hub VNet through an ErGw3AZ ExpressRoute gateway. A latency-sensitive trading application running on VMs in a spoke VNet requires the lowest possible network latency and highest throughput for data flowing between on-premises and the VMs. Network engineers observe that traffic is being processed by the ExpressRoute gateway, adding latency. Which feature should you enable to send data traffic directly to the VMs, bypassing the gateway in the data path?

Your company has a 10 Gbps ExpressRoute Direct circuit terminating in an ExpressRoute virtual network gateway. Application teams report that traffic between on-premises servers and Azure VMs is being throttled and adds noticeable latency because it must traverse the gateway data path. You want to enable FastPath so that data-plane traffic bypasses the ExpressRoute gateway and flows directly to the VMs. Which ExpressRoute gateway SKU must you deploy to support FastPath?

Contoso has two ExpressRoute circuits, each terminating in a different region: one connects a data center in London (peered at a London provider location) and another connects a data center in Chicago (peered at a Chicago provider location). Both circuits use private peering and connect to Azure VNets successfully. The network team now needs the London and Chicago on-premises data centers to communicate directly with each other over the Microsoft backbone, without routing traffic through an Azure VNet or the public internet. Which solution meets this requirement?

Contoso has two ExpressRoute circuits: one in the East US peering location connecting their New York data center, and one in the West Europe peering location connecting their Amsterdam data center. Each circuit is linked to an ExpressRoute gateway in a separate Azure VNet. The network team needs the New York and Amsterdam on-premises sites to communicate directly with each other over the Microsoft backbone, without routing traffic through an Azure VNet or the public internet. Which solution meets this requirement?

Your company has an ExpressRoute circuit with a Premium SKU. The networking team wants to access Microsoft 365 services and Azure PaaS services (such as Azure Storage public endpoints) over the ExpressRoute circuit instead of the public internet. You need to configure the correct peering type and meet Microsoft's requirements for advertising public prefixes. What must you configure?

Your company has provisioned an ExpressRoute circuit at 5 Gbps with a service provider to connect an on-premises datacenter to Azure. You need to connect an Azure virtual network to the circuit using private peering. The design must support the full 5 Gbps of circuit bandwidth to the virtual network and also enable FastPath so that data-plane traffic bypasses the gateway. Which ExpressRoute virtual network gateway SKU should you deploy?

You are configuring a Point-to-Site (P2S) VPN on an existing route-based VPN gateway (VpnGw2) for a company with 300 remote users. Security requires that users authenticate with their Microsoft Entra ID (Azure AD) credentials, including Conditional Access and MFA enforcement. The users connect from Windows 10 and Windows 11 devices. Which tunnel type and client configuration must you select to support Microsoft Entra ID authentication?

Your company wants to deploy a point-to-site (P2S) VPN so remote employees can connect to an Azure VNet. Security requires that user authentication be performed against your existing on-premises Active Directory using an on-premises RADIUS server (NPS). You must select a VPN gateway SKU that supports RADIUS authentication. The existing gateway is currently the Basic SKU. What must you do to meet the requirement?

Your company runs a business-critical workload in Azure that requires a highly available site-to-site VPN connection to the on-premises data center. The on-premises edge consists of two independent VPN devices, each with its own public IP address. You must design the Azure VPN gateway so that a failure of a single Azure gateway instance OR a single on-premises VPN device does not interrupt connectivity. Which design should you implement?

Your company establishes a site-to-site VPN between an Azure route-based VPN gateway (VpnGw2) and an on-premises firewall. The connection reaches the 'Connecting' state but never becomes 'Connected'. Azure diagnostic logs show that IKE Phase 1 negotiation repeatedly fails. You confirm the shared key matches on both sides and the on-premises public IP is correctly set in the local network gateway. The on-premises firewall administrator reports the tunnel is configured for IKEv1 with a policy-based (all-or-nothing) traffic selector. What is the MOST likely cause of the failure?

Your company must connect an Azure VNet to an on-premises data center using a Site-to-Site VPN. The on-premises device is a legacy firewall that only supports IKEv1 and requires a single traffic selector pair (a policy-based/static-routing tunnel). You need to deploy an Azure VPN gateway that can terminate this connection while keeping costs minimal. Which gateway configuration meets the requirement?

Contoso operates branch offices and Azure workloads across three geographic areas: North America, Western Europe, and Southeast Asia. They deploy Azure Virtual WAN and want branches in each area to connect to the nearest presence for lowest latency, while all hubs and spoke VNets communicate transitively with any-to-any connectivity. Which virtual hub deployment approach meets these requirements with the least administrative effort?

Your company deploys an Azure Virtual WAN with a single secured virtual hub. The hub contains an integrated Azure Firewall. Two spoke VNets are connected to the hub, and a site-to-site VPN connects an on-premises branch. Security policy requires that all traffic between the two spokes, between spokes and the branch, and to the internet be inspected by the Azure Firewall. You must configure this with the least administrative effort and without manually authoring per-VNet route tables. What should you configure on the virtual hub?

Your company deploys an Azure Virtual WAN with a single virtual hub. A branch is connected to the hub via both an ExpressRoute circuit (private peering) and a Site-to-Site VPN for redundancy. The same on-premises prefixes are advertised over both paths using BGP. You want the virtual hub to prefer the Site-to-Site VPN path over ExpressRoute for traffic destined to on-premises, without changing on-premises BGP attributes or removing either connection. What should you configure?

Your company uses Azure Virtual WAN with several virtual hubs connecting branch offices and Azure VNets. Security policy requires all traffic to pass through a specific vendor's next-generation firewall that the vendor publishes as a managed offering in the Azure Marketplace. You must deploy this firewall directly inside the virtual hubs so it can inspect branch-to-VNet and branch-to-internet traffic without deploying and managing separate VMs in spoke VNets. Which Virtual WAN configuration meets this requirement?

Your company deploys an Azure Virtual WAN with two secured virtual hubs, each containing an Azure Firewall. Several spoke VNets are connected to each hub, and the hubs are connected to each other through the Virtual WAN backbone. Security requires that ALL traffic between spoke VNets (both within the same hub and across hubs) be inspected by Azure Firewall. You want to enforce this with the least ongoing administrative effort and without manually maintaining route tables on every spoke. What should you configure?