AZ-500 Secure networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create two local network gateways, each with one on-premises public IP, and connect each to a different IP of the VPN gateway.

  Why this is correct

  In active-active mode, the Azure VPN gateway is deployed with two public IP addresses, and the correct configuration requires two separate on-premises VPN devices, each represented by its own local network gateway. By creating a local network gateway for each on-premises public IP and connecting each one to a different gateway IP address via separate connections, you establish two independent IPsec tunnels that operate concurrently. This satisfies high availability because failure of one on-premises device or one Azure gateway instance still leaves a functional tunnel. Without this placement — one local network gateway per on-premises IP — the gateway cannot build active-active tunnels to two distinct on-premises endpoints.

• ✗

  Create one local network gateway that includes both on-premises IP addresses and enable BGP on the connection.

  Why it's wrong here

  A local network gateway resource represents a single on-premises site and accepts only one public IP address for the remote VPN device; you cannot include two on-premises IP addresses in a single local network gateway definition. Although enabling BGP on the connection supports dynamic routing and automatic failover between tunnels, BGP does not change the fundamental constraint that each local network gateway must point to exactly one on-premises endpoint. To utilize two on-premises IPs, you must create two local network gateways regardless of BGP use, which means this option is not a valid alternative.

• ✗

  Use active-passive mode and configure a second VPN gateway in the same virtual network.

  Why it's wrong here

  A virtual network can contain only one VPN gateway resource, so you cannot deploy a second active-passive VPN gateway into the same VNet to achieve high availability. Active-passive mode already provides a redundant gateway instance, but that standby instance is not used for active traffic and does not leverage two on-premises devices; it only fails over to the standby tunnel. Furthermore, active-passive mode still uses a single gateway with one public IP (or optional BGP), and it does not meet the requirement of running active-active connections to separate on-premises devices concurrently.

• ✗

  Deploy two separate VPN gateways in different Azure regions.

  Why it's wrong here

  Deploying two separate VPN gateways in different Azure regions provides regional redundancy, also known as geo-redundancy, which is a different availability scenario than active-active mode within a single gateway. These gateways would belong to different virtual networks and would require additional configuration such as VNet-to-VNet peering or a shared on-premises device, and they do not form two active tunnels from the same gateway to the same on-premises site. The question specifically asks for active-active mode, which is a property of a single VPN gateway instance using two public IPs, so this regional approach does not satisfy the stated architecture.

Go deeper

Related to this question