hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Designing a secure hybrid network architecture
A company is designing a secure hybrid network architecture. They have an on-premises network connected to Azure via ExpressRoute and a site-to-site VPN as backup. They want to ensure that traffic from Azure to on-premises always uses ExpressRoute when available, but automatically fails over to VPN if ExpressRoute goes down. Which configuration should they implement?
⚠ Common exam trap
It's easy for candidates to confuse BGP weight (Cisco-proprietary, local to a router) with local preference (standard, AS-wide), and incorrectly assume that lowering weight on the VPN would achieve the same result as raising local preference on ExpressRoute, but Azure does not support Cisco weight and local preference is the correct attribute for influencing outbound traffic from Azure to on-premises.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.
BGP local preference is an attribute used to influence outbound traffic from an AS. By assigning a higher local preference (e.g., 200) to routes learned via ExpressRoute, Azure will prefer those routes over VPN routes (which default to local preference 100). This ensures that traffic from Azure to on-premises uses ExpressRoute when available, and automatically fails over to the VPN if the ExpressRoute BGP session drops, as the VPN routes will then be selected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the VPN to have a lower BGP weight than ExpressRoute.
Why it's wrong here
BGP weight is a Cisco-proprietary, locally significant attribute that is not exchanged with BGP peers and is only evaluated on a single router. Setting the VPN's weight lower than ExpressRoute would make the VPN less preferred on that router, but it provides no deterministic failover guarantee because the attribute is not standardized or replicated across the AS. More importantly, Azure's route selection uses standard BGP attributes, so manipulating weight alone does not ensure that Azure or other on-premises routers will honor the preference. This approach fails the requirement for a clear primary/backup design where ExpressRoute is always favored unless it fails.
- ✗
Use both connections in active-active mode with BGP and rely on ECMP.
Why it's wrong here
Configuring both connections in active-active mode with BGP and relying on equal-cost multipath (ECMP) distributes traffic across both links instead of establishing a favored primary path. ECMP is intended for load balancing and requires paths to be equal cost, which is unrealistic when ExpressRoute and a VPN have different bandwidth, latency, and availability characteristics. The requirement explicitly calls for failover from ExpressRoute to VPN, not simultaneous use, so active-active ECMP would not provide deterministic failover behavior or a preferred route selection.
- ✗
Disable BGP on the VPN connection and use static routes with a higher metric for the VPN.
Why it's wrong here
Disabling BGP on the VPN connection and using static routes with a higher metric would make VPN a fallback, but it strips the VPN's capability to dynamically advertise or withdraw routes during failure. Static routes cannot adapt to real-time connectivity changes, so when ExpressRoute goes down, the VPN gateway may not automatically update its routing table to install the static fallback route, causing prolonged blackholing. Additionally, without BGP, you lose automatic route propagation between Azure and on-premises, making the solution fragile and increasing operational overhead compared to dynamic BGP-based failover.
- ✓
Configure BGP on both connections and assign a higher local preference (e.g., 200) to routes learned via ExpressRoute.
Why this is correct
BGP local preference is a standard, AS-wide attribute used to select the preferred path for outbound traffic, with higher values (e.g., 200) being preferred over the default of 100. By enabling BGP on both connections and assigning a higher local preference to routes learned via ExpressRoute, both on-premises devices and (with appropriate configuration) peers will consistently prefer ExpressRoute for all traffic. When ExpressRoute fails and its routes are withdrawn, the VPN route automatically becomes the best path because it carries the lower local preference, enabling seamless and deterministic failover. This approach is platform-independent, unlike proprietary weight, and gives explicit control over the primary/backup relationship.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.