AZ-305 Design infrastructure solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A

  Why this is correct

  This is the correct design because each data center establishes its own dedicated ExpressRoute circuit as the primary path, ensuring predictable, high-bandwidth, and low-latency connectivity to Azure with an SLA-backed private link. The site-to-site VPN for each data center acts as an IPsec-based backup over the internet, providing a cost-effective failover path that automatically kicks in if the ExpressRoute circuit fails. This active/passive redundancy model is a best practice for hybrid networking, as it avoids a single point of failure while keeping operational costs reasonable.

• ✗

  B

  Why it's wrong here

  This design is incorrect because site-to-site VPNs traverse the public internet and offer only best-effort throughput, which is unlikely to meet the high-bandwidth and low-latency requirements of enterprise workloads; conversely, using ExpressRoute as a backup is financially impractical because you would be paying for dedicated circuits that remain idle most of the time. While VPN can be a backup, it should not be the primary for critical workloads that need consistent performance and a private network path. Therefore, Option B places the higher-performing, more reliable service as the backup rather than the primary, inverting the correct architecture.

• ✗

  C

  Why it's wrong here

  This option is flawed because a single Azure VPN Gateway, even in active-passive mode, is primarily a VPN endpoint and does not provide the dedicated private connectivity, consistent throughput, or lower latency of ExpressRoute. Additionally, relying on one gateway instance to serve connections from both data centers introduces a single point of failure for the entire hybrid network—if that gateway fails or is patched, both sites lose connectivity. This would not satisfy a requirement for high reliability from two independent data centers, and the active-passive configuration only protects against certain gateway-level failures, not the lack of a dedicated WAN link.

• ✗

  D

  Why it's wrong here

  This option is technically impractical because a single ExpressRoute circuit with a single VPN connection shared across two data centers creates a single point of failure and cannot provide independent path redundancy for each location. Each data center needs its own dedicated primary and backup circuit to launch a true site-to-site-to-Azure redundancy; sharing one circuit would require a complex and fragile network topology, likely with insufficient bandwidth for aggregated traffic, and any outage or maintenance on the shared circuit would simultaneously affect both data centers. This design does not meet the core objectives of high availability, fault isolation, and predictable performance across geographically separate sites.

Go deeper

Related to this question