A company is establishing connectivity between its on-premises headquarters and an Azure Virtual Network. The connection must bypass the public internet to ensure predictable performance and security. Additionally, the company's internal compliance policy mandates that all data in transit must be encrypted at the network layer using IPsec. Which solution satisfies all of these requirements?
- A Site-to-Site VPN gateway connection configured over an Azure ExpressRoute private peering connectionAnswer
- BAn Azure ExpressRoute connection configured with Microsoft peering to encrypt traffic using native IPsec over the public internet
- CA standard Site-to-Site VPN gateway connection using a public IP address over the public internet
- DAn Azure Virtual Network peering connection configured with a public VPN Gateway transit
Answer
A Site-to-Site VPN gateway connection configured over an Azure ExpressRoute private peering connection
The correct option is the Site-to-Site VPN gateway connection configured over an Azure ExpressRoute private peering connection. ExpressRoute provides a dedicated, private connection that does not traverse the public internet, ensuring predictable performance. Since ExpressRoute does not natively encrypt traffic, configuring a VPN tunnel over the private peering allows the traffic to be encrypted using IPsec, meeting both constraints.
Step-by-Step Solution
Key Concept
Azure Virtual Networks, ExpressRoute, and VPN Gateway hybrid design