Microsoft Azure Solutions Architect Expert AZ-305 Practice Question

Azure ExpressRoute provides private Layer-3 connectivity over dedicated circuits that do not traverse the public Internet, so IPsec encryption is optional rather than required. Purchasing ExpressRoute Direct with a dual 10-Gbps port pair supplies two physically diverse connections that can operate in active-active mode for up to 20 Gbps of aggregate throughput. When two redundant circuits are provisioned, Microsoft offers a 99.95 percent end-to-end connectivity SLA.

By contrast, VPN-based approaches-whether individual route-based VPN gateways or Virtual WAN hubs-use IPsec tunnels over the public Internet, add encryption overhead, and each individual VPN gateway is limited to a maximum of 10 Gbps (VpnGw5), so they cannot simultaneously meet the encryption and bandwidth requirements. Application Gateway is an application-layer load balancer and does not provide site-to-site network connectivity. Therefore, ExpressRoute Direct with dual 10-Gbps circuits and private peering is the only option that satisfies all stated constraints.