AZ-500 ExpressRoute circuit Practice Question
Which TWO components are required to implement a secure hybrid network that connects on-premises to Azure using ExpressRoute? (Choose two.)
⚠ Common exam trap
A common trap is assuming the Azure VPN Gateway is a required component for ExpressRoute. In fact, it is only used for failover and is not mandatory. The required components are the ExpressRoute circuit and the virtual network gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual network gateway in Azure.
Option A is correct because an ExpressRoute connection terminates on a virtual network gateway of type 'ExpressRoute' (ExpressRouteGateway) deployed in the Azure virtual network's GatewaySubnet, which is the mandatory Azure-side endpoint that peers with the ExpressRoute circuit. Option B is correct because the ExpressRoute circuit is the connectivity resource provisioned through a connectivity provider (or ExpressRoute Direct) that establishes the private Layer 3 connection between on-premises and Microsoft's edge, and it is the fundamental component required for any ExpressRoute-based hybrid network. Option C is not required for the connectivity itself; Azure Firewall is an optional security service for traffic inspection and does not establish the ExpressRoute link. Option D is not required because a VPN Gateway is only an optional failover path (or a separate S2S VPN design), not a mandatory component of an ExpressRoute implementation. Option E is not required because Azure Front Door is a global Layer 7 HTTP/HTTPS load balancer and CDN service, unrelated to private ExpressRoute hybrid connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Virtual network gateway in Azure.
Why this is correct
A virtual network gateway in Azure is the required ExpressRoute gateway deployed in the gateway subnet of a virtual network. It terminates the ExpressRoute circuit at the Azure side and enables routing between on-premises networks and the VNet, with SKUs like ErGw1Az/ErGw2Az/ErGw3Az. Without this gateway, the circuit cannot be attached to a virtual network.
- ✓
ExpressRoute circuit.
Why this is correct
The ExpressRoute circuit is the primary private connection between your on-premises edge and Microsoft network, provided by a connectivity provider at Layer 2 or Layer 3. It connects into Microsoft Enterprise Edge (MSEE) routers via peering locations, offering higher reliability and bandwidth than the internet. This circuit is absolutely required because it delivers the dedicated, private path that defines ExpressRoute.
- ✗
Azure Firewall.
Why it's wrong here
Azure Firewall is an optional managed cloud-native firewall service that provides stateful L3/L4 filtering, threat intelligence, and egress control for workloads. It is not a prerequisite for ExpressRoute hybrid connectivity, because ExpressRoute handles private, dedicated IP routing without requiring inspection. You can deploy Azure Firewall in a topology for security, but it is not one of the three essential components.
- ✗
Azure VPN Gateway for failover.
Why it's wrong here
A VPN Gateway is an optional cross-premises connectivity component that carries Site-to-Site IPSec/IKE traffic over the public internet. In an ExpressRoute design, a separate Azure VPN Gateway is commonly used as a redundant failover path if the ExpressRoute circuit fails, but it is not mandatory for establishing the ExpressRoute connection. ExpressRoute does not depend on VPN Gateway for its operation.
- ✗
Azure Front Door.
Why it's wrong here
Azure Front Door is a global Layer 7 reverse proxy and load balancer that accelerates delivery of web applications over HTTP/S, with capabilities like SSL termination, WAF, and URL-based routing. It operates at the application protocol level and has no role in establishing private IP-level hybrid networking between on-premises and Azure. Therefore, it is never a required component for ExpressRoute architectures.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.