AZ-104 Certification Practice Question #226

Question

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using
Azure ExpressRoute.
You plan to prepare the environment for automatic failover in case of ExpressRoute failure.
You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

To establish a site-to-site VPN connection as a backup to an existing ExpressRoute circuit, three key components are required: a VPN gateway, a local network gateway (representing the on-premises VPN device), and a connection resource connecting the two. 
1. Because VNet1 is already connected to ExpressRoute, a `GatewaySubnet` **already exists** in the virtual network, so creating another one (D) is not required (nor is it allowed, as a VNet can only have one gateway subnet).
2. Microsoft's ExpressRoute and VPN Gateway coexistence configuration **does not support the Basic SKU** for the VPN gateway. Therefore, the cost-effective `VpnGw1` SKU (C) must be used instead of the Basic SKU (E).
3. Thus, the three required actions to complete the VPN setup are creating the local network gateway (B), creating the `VpnGw1` VPN gateway (C), and establishing the connection resource between them (A).

More AZ-104 practice questions