VPN Gateway for hybrid connectivity in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Choosing the right VPN Gateway SKU for hybrid connectivity

You need to connect your on-premises network to Azure using a VPN Gateway. Your on-premises network has high traffic and requires support for multiple tunnels. Which VPN Gateway SKU should you choose?

A VpnGw3 SKU, supports multiple tunnels and high bandwidth

B VpnGw1 SKU, supports multiple tunnels and moderate bandwidth

C Basic SKU, supports up to 1 tunnel and low bandwidth

D Standard SKU, supports multiple tunnels and moderate bandwidth

💡 Hint

Consider the number of tunnels and bandwidth needed for your hybrid network.

The VpnGw3 SKU supports multiple tunnels and high bandwidth, making it suitable for high traffic hybrid connectivity scenarios. Basic SKU has limitations in tunnels and bandwidth, and Standard SKU supports multiple tunnels but with moderate bandwidth.

❓ service_behavior

intermediate

Behavior of BGP with Azure VPN Gateway

You configure BGP (Border Gateway Protocol) on your Azure VPN Gateway and your on-premises VPN device. What is the expected behavior when BGP is enabled?

A BGP advertises routes dynamically between Azure and on-premises networks

B Routes are statically configured and do not change dynamically

C BGP disables VPN tunnels and uses ExpressRoute instead

D BGP only works with Basic SKU VPN Gateways

💡 Hint

Think about what BGP does in network routing.

BGP dynamically advertises routes between Azure VPN Gateway and on-premises devices, allowing automatic route updates and failover. Static routes are not used when BGP is enabled.

❓ security

advanced

Securing VPN Gateway connections with IPsec/IKE policies

You want to enforce specific encryption and hashing algorithms for your VPN Gateway connections to comply with your company's security policy. Which Azure feature allows you to customize these settings?

A Set up Network Security Groups (NSGs) on the VPN Gateway subnet

B Configure IPsec/IKE policy on the VPN Gateway connection

C Enable Azure DDoS Protection on the VPN Gateway

D Use Azure Firewall to filter VPN traffic

💡 Hint

Look for a feature that controls encryption and hashing algorithms on VPN tunnels.

IPsec/IKE policies allow customization of encryption, integrity, and DH group algorithms for VPN Gateway connections, ensuring compliance with security requirements.

❓ Configuration

advanced

Configuring active-active VPN Gateway for high availability

You want to configure an Azure VPN Gateway in active-active mode to ensure high availability for your hybrid connection. Which of the following is a required step?

A Deploy two VPN Gateways in different regions and connect them with ExpressRoute

B Use Basic SKU VPN Gateway with multiple tunnels enabled

C Enable active-active mode on a VpnGw2 or higher SKU and configure two public IP addresses

D Configure BGP only on one tunnel and disable it on the other

💡 Hint

Active-active mode requires specific SKU and multiple IP addresses.

Active-active VPN Gateway requires VpnGw2 or higher SKU and two public IP addresses to enable two active tunnels for high availability.

✅ Best Practice

expert

Optimizing hybrid connectivity with VPN Gateway and ExpressRoute

Your company uses both VPN Gateway and ExpressRoute to connect on-premises to Azure. You want to optimize routing and failover between these connections. Which approach follows best practices?

A Use ExpressRoute for all traffic and disable VPN Gateway to avoid conflicts

B Use VPN Gateway only for backup and disable BGP on ExpressRoute

C Configure static routes on VPN Gateway and dynamic routes on ExpressRoute without BGP

D Advertise all on-premises routes over both VPN Gateway and ExpressRoute with BGP, and configure route priorities

💡 Hint

Think about how to use BGP and route priorities for failover.

Advertising routes over both VPN Gateway and ExpressRoute with BGP and setting route priorities allows automatic failover and optimized routing between connections.