AZ-305 Design infrastructure solutions Practice Question
You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?
⚠ Common exam trap
Watch out — candidates often confuse BGP metrics (MED) with local preference; local preference is used for outbound path selection within an AS, while MED influences inbound path selection from a neighbor AS, and Azure uses MED for route preference in hybrid connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.
B is correct because when both ExpressRoute and VPN connections use BGP to advertise routes to Azure, Azure automatically selects the route with the lowest BGP metric (MED). By configuring the ExpressRoute connection with a lower BGP metric than the VPN connection, Azure will prefer the ExpressRoute path under normal conditions. If the ExpressRoute fails, its routes are withdrawn, and Azure falls back to the VPN routes, providing automatic failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.
Why it's wrong here
Azure Traffic Manager operates at the DNS layer, resolving domain names to endpoints, and does not influence the underlying IP routing or BGP path selection between ExpressRoute and a VPN gateway. A priority routing method can only control which front-end endpoint receives new DNS queries, not which physical WAN link carries packet traffic during an ExpressRoute outage. Therefore, Traffic Manager cannot serve as a network-level failover mechanism for hybrid connectivity, and the correct control is the BGP metric on the gateway connections.
- ✓
Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.
Why this is correct
ExpressRoute and VPN gateway BGP peering allow Azure to choose between the two paths by comparing BGP attributes; a lower BGP metric (such as MED) on the ExpressRoute connection makes it the preferred route because Azure selects the path with the lowest metric. When the ExpressRoute circuit fails, its route is withdrawn and the VPN route with the higher metric becomes the only available path, enabling automatic failover. This is the standard, supported coexistence design for resilient hybrid networking, and no additional traffic-management or routing services are required.
- ✗
Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.
Why it's wrong here
Setting the BGP metric (or local preference) higher on the ExpressRoute connection is counterproductive because, for the BGP MED attribute, a lower value is preferred during path selection. If the ExpressRoute route carries a higher MED than the VPN route, Azure will select the VPN as the primary path, meaning normal traffic is sent over VPN even when ExpressRoute is healthy. The correct configuration is to keep the ExpressRoute metric lower; raising it would invert the intended priority and cause suboptimal routing or failover behavior.
- ✗
Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.
Why it's wrong here
Azure Route Server is used to exchange routes between Azure Virtual Network and network virtual appliances (NVAs), not to configure the BGP metrics of a VPN gateway or ExpressRoute circuit. Even if Route Server propagated a lower metric for the VPN routes, that would cause Azure to prefer the VPN over ExpressRoute, defeating the goal of using ExpressRoute as the primary path. Route Server does not participate in the gateway's selection between ExpressRoute and VPN, and it is unnecessary for this scenario; BGP metrics are set directly on the connections themselves.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.