AZ-700 Azure Routing 2 — Questions and Answers
Question 1: What is the default BGP Autonomous System Number (ASN) used by Azure VPN Gateways?
- 65000
- 65515 (Correct answer)
- 12076
- 64512
Correct answer: 65515
Azure VPN Gateways use BGP ASN 65515 by default; note that Microsoft's ExpressRoute edge routers use the separate ASN 12076.
Question 2: Which routing protocol does Azure use to dynamically exchange routes between an ExpressRoute gateway and on-premises routers?
- OSPF
- RIP v2
- BGP (Border Gateway Protocol) (Correct answer)
- EIGRP
Correct answer: BGP (Border Gateway Protocol)
Azure ExpressRoute exclusively uses BGP to exchange routing information between Azure and on-premises or provider edge routers.
Question 3: What is Azure Route Server primarily designed to accomplish?
- Replace Azure Load Balancer for north-south traffic distribution
- Enable dynamic BGP route exchange between network virtual appliances and Azure virtual network gateways (Correct answer)
- Provide DNS-based traffic routing across Azure regions
- Aggregate and summarize routes advertised from on-premises networks
Correct answer: Enable dynamic BGP route exchange between network virtual appliances and Azure virtual network gateways
Azure Route Server acts as a BGP route reflector that enables NVAs to dynamically exchange routes with Azure's VPN and ExpressRoute gateways without requiring manual UDRs.
Question 4: When configuring BGP on an Azure VPN Gateway, what must the on-premises VPN device use as the BGP neighbor IP address?
- The Azure gateway's public IP address
- The Azure gateway's BGP IP address assigned within the GatewaySubnet (Correct answer)
- Any IP address within the on-premises network range
- The Azure VNet's first usable IP address
Correct answer: The Azure gateway's BGP IP address assigned within the GatewaySubnet
BGP sessions are established using the gateway's BGP IP address (from GatewaySubnet address space), not its public IP, because BGP runs over the tunnel after it is established.
Question 5: Which Azure VPN Gateway SKU does NOT support BGP?
- VpnGw1
- VpnGw2
- Basic (Correct answer)
- VpnGw1AZ
Correct answer: Basic
The Basic SKU does not support BGP; all VpnGw1 and higher SKUs (including AZ variants) support BGP for dynamic routing.
Question 6: What are APIPA BGP IP addresses (169.254.x.x) used for in Azure VPN Gateways?
- Assigning public IPs to gateway tunnel interfaces
- Enabling BGP peering in active-active configurations without consuming GatewaySubnet address space (Correct answer)
- Configuring split tunneling for site-to-site VPN connections
- Providing fallback routing when the primary BGP session fails
Correct answer: Enabling BGP peering in active-active configurations without consuming GatewaySubnet address space
APIPA BGP addresses (in the 169.254.21.x and 169.254.22.x ranges) allow active-active VPN gateways to establish BGP sessions over IPsec tunnels without requiring extra IP addresses from the GatewaySubnet.
Question 7: In a hub-spoke VNet topology using Azure Route Server, what configuration change is needed to allow spokes to learn each other's routes through the hub NVA?
- Enable VNet peering transitivity in the Azure portal
- Enable 'Branch-to-Branch' traffic on Azure Route Server (Correct answer)
- Create static UDRs in each spoke pointing to the NVA
- Configure BGP route reflector clusters on the gateway
Correct answer: Enable 'Branch-to-Branch' traffic on Azure Route Server
Enabling the 'Branch-to-Branch' (also called hub-and-spoke or spoke-to-spoke) setting on Azure Route Server allows it to advertise routes between connected NVA BGP peers, enabling spoke-to-spoke routing via the hub NVA.
AZ-700 Azure Routing 2
What is the default BGP Autonomous System Number (ASN) used by Azure VPN Gateways?