AZ-305 Design infrastructure solutions Practice Question
Your company is designing a hybrid network architecture that connects multiple on-premises sites to Azure. You need to ensure high availability and redundancy for the connection. Which TWO solutions should you recommend? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse redundancy at the gateway level (active-active vs. active-standby) with redundancy at the circuit level, and may incorrectly select a single ExpressRoute circuit with a VPN failover, which still has a single point of failure for the circuit itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy two ExpressRoute circuits in active-passive mode
Deploying two ExpressRoute circuits in active-passive mode provides redundancy for the on-premises-to-Azure connection. If the primary circuit fails, traffic automatically fails over to the passive circuit, ensuring high availability. Option C is correct because an Azure VPN Gateway in active-active mode uses two active tunnels to provide redundancy and load balancing, which is essential for a highly available hybrid network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy two ExpressRoute circuits in active-passive mode
Why this is correct
Deploying two ExpressRoute circuits in active-passive mode is correct because each circuit represents a physically distinct path, ideally from different providers and peering locations, to Microsoft's edge, eliminating a single point of failure in the private network. BGP determines the primary path through route preference mechanisms such as local preference or AS path prepend, and on failure the secondary circuit automatically takes over without any configuration change. This architecture satisfies a high-availability hybrid networking requirement and enables the ExpressRoute service-level agreement.
- ✗
Implement Azure DNS Private Resolver for resolution
Why it's wrong here
Azure DNS Private Resolver provides recursive resolution and conditional forwarding for private DNS zones between on-premises and Azure virtual networks, but it is not a data-plane network connectivity service. It neither carries application traffic nor provides link failover or bandwidth; even if DNS queries resolve correctly, an outage on the underlying IP connectivity path will still prevent access to workloads. Choosing this option would address name resolution, not the required hybrid connectivity redundancy.
- ✓
Use Azure VPN Gateway in active-active mode
Why this is correct
Using an Azure VPN Gateway in active-active mode is also a valid redundancy design because Azure deploys two gateway instances, each with its own public IP and a separate IPsec tunnel to the on-premises VPN device, with BGP load-balancing or failing over between the tunnels. This protects against an instance-level failure and can be paired with ExpressRoute as a failover path. However, it uses internet-based VPN connectivity, so it cannot match the dedicated throughput and 99.95% SLA of two ExpressRoute circuits.
- ✗
Use a single VPN gateway with active-standby mode
Why it's wrong here
A single VPN gateway in active-standby mode is insufficient when the goal is overall hybrid network resilience because the gateway resource is still reliant on one underlying gateway site and one public IP, and it does not provide an independent network path for failover. The standby instance inside the same gateway only protects against an OS fault or instance maintenance, not against a regional Azure outage, an internet provider outage, or a loss of the site-to-site VPN connection. To achieve redundancy, you need either multiple gateway deployments or a second independent connection such as a second ExpressRoute circuit.
- ✗
Use a single ExpressRoute circuit with a VPN gateway as failover
Why it's wrong here
A single ExpressRoute circuit backed by a VPN gateway gives you a fallback path, but it is not as redundant as two ExpressRoute circuits because the sole circuit remains a single point of failure in the private interconnect. If the circuit experiences a fiber cut, connectivity-provider maintenance, or BGP peering loss, failover to the VPN tunnel depends on IPsec convergence and is usually constrained by the VPN Gateway's throughput, which is often lower than ExpressRoute. Meeting a strict enterprise SLA generally requires two diverse ExpressRoute circuits, not one circuit plus a best-effort VPN.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.