Your organization requires a Site-to-Site (S2S) VPN connection to Azure with the highest possible availability. You must ensure that if one VPN tunnel fails, or if maintenance occurs on the Azure VPN Gateway, the connection remains active without manual intervention. How should you configure the gateway?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Deploy an active-active VPN Gateway and configure two local network gateways representing two distinct on-premises VPN devices

An active-active VPN Gateway provisions two gateway instances in Azure, each with its own public IP. By connecting both instances to two separate on-premises VPN devices, you creat...

📋Part of Microsoft Certified: Azure Network Engineer Associate (AZ-700) · Azure Certification Practice
Real Exam ScenarioVPN Gateway

Your organization requires a Site-to-Site (S2S) VPN connection to Azure with the highest possible availability. You must ensure that if one VPN tunnel fails, or if maintenance occurs on the Azure VPN Gateway, the connection remains active without manual intervention. How should you configure the gateway?

✓ Correct Answer & ExplanationVPN Gateway

Correct Answer

Deploy an active-active VPN Gateway and configure two local network gateways representing two distinct on-premises VPN devices

Why This Answer Is Correct

An active-active VPN Gateway provisions two gateway instances in Azure, each with its own public IP. By connecting both instances to two separate on-premises VPN devices, you create a full mesh of 4 IPsec tunnels. This ensures maximum availability against both Azure maintenance events and on-premises hardware failures.

📚 What This Question Tests

This question evaluates your knowledge of VPN Gateway — a core concept tested in Microsoft Certified: Azure Network Engineer Associate (AZ-700). Understanding VPN Gateway is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Azure Network Engineer Associate (AZ-700) Questions →Browse All Azure Exams →

More VPN Gateway Practice Questions

You are configuring a Point-to-Site (P2S) VPN for remote workers. The company requires that users authenticate using their Azure Active Directory (Entra ID) credentials and enforce Conditional Access policies (like MFA). Which tunnel type must you select?

← Back to Microsoft Certified: Azure Network Engineer Associate (AZ-700) Full Practice Hub