You are configuring a Point-to-Site (P2S) VPN for remote workers. The company requires that users authenticate using their Azure Active Directory (Entra ID) credentials and enforce Conditional Access policies (like MFA). Which tunnel type must you select?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: OpenVPN

To use Azure Active Directory (Entra ID) authentication for a Point-to-Site VPN, the tunnel type must be set to OpenVPN. Native Azure AD authentication is only supported with the O...

📋Part of Microsoft Certified: Azure Network Engineer Associate (AZ-700) · Azure Certification Practice
Real Exam ScenarioVPN Gateway

You are configuring a Point-to-Site (P2S) VPN for remote workers. The company requires that users authenticate using their Azure Active Directory (Entra ID) credentials and enforce Conditional Access policies (like MFA). Which tunnel type must you select?

✓ Correct Answer & ExplanationVPN Gateway

Correct Answer

OpenVPN

Why This Answer Is Correct

To use Azure Active Directory (Entra ID) authentication for a Point-to-Site VPN, the tunnel type must be set to OpenVPN. Native Azure AD authentication is only supported with the OpenVPN protocol and the Azure VPN Client. SSTP and IKEv2 only support Certificate or RADIUS authentication.

📚 What This Question Tests

This question evaluates your knowledge of VPN Gateway — a core concept tested in Microsoft Certified: Azure Network Engineer Associate (AZ-700). Understanding VPN Gateway is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Azure Network Engineer Associate (AZ-700) Questions →Browse All Azure Exams →

More VPN Gateway Practice Questions

Your organization requires a Site-to-Site (S2S) VPN connection to Azure with the highest possible availability. You must ensure that if one VPN tunnel fails, or if maintenance occurs on the Azure VPN Gateway, the connection remains active without manual intervention. How should you configure the gateway?

← Back to Microsoft Certified: Azure Network Engineer Associate (AZ-700) Full Practice Hub