AZ-305 Design infrastructure solutions Practice Question
A company has an Azure virtual network (VNet) in the East US region hosting a web application. They need to securely connect to an on-premises data center in the same region using a dedicated, private network connection with high throughput and low latency. They also need a backup connection for redundancy in case the primary connection fails. Which connectivity solution should they implement?
⚠ Common exam trap
A common mix-up: candidates choose ExpressRoute only, forgetting that it lacks built-in redundancy and that a Site-to-Site VPN is the standard, cost-effective backup for ExpressRoute circuits in the same region.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ExpressRoute as primary with Site-to-Site VPN as backup
ExpressRoute provides a dedicated, private, high-throughput, low-latency connection to Azure, ideal for the primary link. A Site-to-Site VPN over the internet serves as a cost-effective, encrypted backup path that activates if the ExpressRoute circuit fails, meeting the redundancy requirement without relying on the same physical infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Site-to-Site VPN only
Why it's wrong here
A Site-to-Site VPN establishes an IPsec tunnel over the public internet, which is a best-effort network with variable latency, jitter, and throughput. While it can be used for encryption and basic connectivity, it cannot provision a dedicated, high-bandwidth link with consistent low latency and a guaranteed SLA for the primary path. For a production workload requiring stable performance, relying solely on VPN makes performance unpredictable and may fail to meet network requirements.
- ✗
ExpressRoute only
Why it's wrong here
ExpressRoute provides a private, dedicated connection to Azure through a service provider, bypassing the public internet and offering a higher SLA. However, a single ExpressRoute circuit is a single point of failure; if the provider suffers an outage, the fiber is cut, or the customer-premises equipment fails, connectivity to Azure is completely lost. ExpressRoute does not inherently provide redundancy unless a second circuit or another connection type is configured, so using it alone fails the resilience requirement.
- ✓
ExpressRoute as primary with Site-to-Site VPN as backup
Why this is correct
The optimal design is an ExpressRoute circuit as the primary path for production traffic, leveraging its dedicated private bandwidth, low latency, and Microsoft SLA. In parallel, a Site-to-Site VPN over the internet serves as a cost-effective backup that automatically takes over if the ExpressRoute circuit fails, especially when implemented with Azure VPN Gateway in active-passive mode or with BGP routing. This hybrid approach satisfies both performance requirements and continuity of connectivity without doubling cost.
- ✗
Azure Virtual WAN with VPN
Why it's wrong here
Azure Virtual WAN is a managed hub-and-spoke networking service that simplifies routing and consolidates multiple connectivity types, but it is not a transport medium. If the planned connectivity uses only a VPN, traffic still traverses the public internet, subject to the same bandwidth, latency, and SLA limitations as any Site-to-Site VPN. Virtual WAN can include ExpressRoute, but this option explicitly specifies VPN only, so it lacks the dedicated private path required for the primary link and does not meet the core performance requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.