VPN Gateway Connectivity
Connectivity items test site-to-site VPN, point-to-site VPN, virtual network gateway SKUs, IKE/IPsec policies, authentication, redundancy, and troubleshooting.
How to study for AZ-700
Treat each AZ-700 item as a traffic-path problem: trace source, destination, DNS, route, next hop, load balancing, private access, and filtering before choosing.
Core concepts
Concept 1
VPN Gateway Connectivity questions test Azure networking design and troubleshooting choices rather than memorized portal paths.
Exam cue: Identify the traffic path, scope, protocol, name resolution behavior, next hop, inspection point, and security control.
Concept 2
The best answer traces traffic from source to destination through addressing, DNS, routing, security, connectivity, and delivery controls.
Exam cue: Choose the Azure networking service that fits reachability, availability, latency, scale, and security requirements.
Concept 3
Eliminate answers that ignore effective routes, name resolution, subnet constraints, private DNS, health probes, or network security boundaries.
Exam cue: Prefer least exposure, private access, validated routes, monitored health, and explicit security policy.
Risk pitfalls and guardrails
Confusing DNS resolution with routing or security filtering.
Guardrail: Avoid answers that confuse DNS with routing, service endpoints with private endpoints, NSGs with firewalls, or layer 4 and layer 7 load balancing.
Opening public access when Private Link, VPN, ExpressRoute, or service endpoints meet the requirement.
Guardrail: Avoid answers that confuse DNS with routing, service endpoints with private endpoints, NSGs with firewalls, or layer 4 and layer 7 load balancing.
Choosing load balancing without matching layer 4, layer 7, regional, global, or DNS-routing behavior.
Guardrail: Avoid answers that confuse DNS with routing, service endpoints with private endpoints, NSGs with firewalls, or layer 4 and layer 7 load balancing.
Memory anchors
VPN Gateway
A VPN gateway provides encrypted connectivity between Azure virtual networks and remote networks or clients.
Site to Site VPN
A site-to-site VPN connects an on-premises network to an Azure virtual network over IPsec/IKE.
Point to Site VPN
A point-to-site VPN lets individual clients connect securely to an Azure virtual network.
Local Network Gateway
A local network gateway represents on-premises VPN device address and routing information.
IKE Policy
An IKE policy defines cryptographic parameters for IPsec/IKE VPN connections.
Route Based VPN
A route-based VPN uses routes and tunnel interfaces to determine encrypted traffic paths.
Policy Based VPN
A policy-based VPN encrypts traffic based on defined address prefixes.
Active Active Gateway
An active-active gateway improves VPN gateway availability with two active instances.
RADIUS Authentication
RADIUS authentication can validate point-to-site VPN users through a central identity system.
Always On VPN
Always On VPN can provide persistent client connectivity with supported configurations.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A branch office needs encrypted connectivity to an Azure VNet over the public internet. Which service should be deployed?
A local network gateway resource is created in Azure. What does it represent?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”