AZ-305 Design infrastructure solutions Practice Question
A company has an on-premises data center and wants to connect it to Azure to extend their network. They require a dedicated, private, high-bandwidth connection that is not routed over the public internet. They also want a lower-cost backup connection for redundancy in case the primary connection fails. Which combination of connectivity options should they implement?
⚠ Common exam trap
Many exam-takers assume two ExpressRoute circuits are required for redundancy, overlooking the cost-effective alternative of using a Site-to-Site VPN as a backup, which still meets the redundancy requirement without the high cost of a second private connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ExpressRoute as the primary connection and a Site-to-Site VPN as the backup connection.
ExpressRoute provides a dedicated, private, high-bandwidth connection that bypasses the public internet, meeting the primary requirement. A Site-to-Site VPN over the internet serves as a cost-effective backup path for redundancy, as it uses encrypted tunnels over the public internet without the recurring costs of a second ExpressRoute circuit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ExpressRoute as the primary connection and a Site-to-Site VPN as the backup connection.
Why this is correct
ExpressRoute is a private, dedicated connection that bypasses the public internet, providing consistent low latency, high bandwidth, and a 99.9% SLA. A Site-to-Site VPN over the public internet is significantly cheaper to maintain as a standby, and because it uses encrypted IPsec tunnels, it can serve as an adequate failover path if the ExpressRoute circuit goes down. This combination meets the requirement for a private primary path while keeping the backup cost-effective.
- ✗
Two ExpressRoute circuits from different service providers, both active.
Why it's wrong here
Deploying two ExpressRoute circuits from different service providers, both active, is a valid strategy for maximizing availability, but it does not satisfy the 'lower cost' requirement. Both circuits carry identical premium pricing, including port and egress charges, so total cost roughly doubles compared to using one ExpressRoute and a VPN backup. Additionally, while active-active placement can distribute traffic, the failure of one circuit still requires the other to carry all load, but the design offers no cost advantage over a single circuit with a cheaper internet-based fallback.
- ✗
Site-to-Site VPN as the primary connection and Point-to-Site VPN as the backup.
Why it's wrong here
Choosing a Site-to-Site VPN as the primary connection fails the 'high bandwidth and private connectivity' requirement because all traffic traverses the public internet and is subject to variable latency and ISP throughput. A Point-to-Site VPN is fundamentally a client-to-Azure tunnel for individual devices, not a site-to-site tunnel between networks, so it cannot act as a backup for an on-premises data center's entire traffic. Even if both are IPsec-based, a P2S tunnel would require per-user credentials and doesn't route whole subnet-to-subnet traffic.
- ✗
Azure VPN Gateway with active-passive mode and a second VPN Gateway for failover.
Why it's wrong here
An Azure VPN Gateway configured in active-passive mode adds redundancy for the VPN endpoint within Azure, but both active and passive instances still terminate IPsec tunnels over the public internet. Adding a second VPN Gateway for failover does not change the underlying transport; it remains internet-based and does not meet the 'private, dedicated' criterion. Furthermore, active-passive mode is designed to handle internal gateway maintenance or zone failures, not to provide a lower-cost alternate path, and two VPN Gateways incur duplicate licensing and data-processing costs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.