Microsoft Azure Security Engineer Associate AZ-500 Practice Question

To control the cryptographic parameters negotiated during tunnel establishment, Azure allows you to attach a custom IPsec/IKE policy to a site-to-site connection when the gateway is route-based. Creating and applying the policy lets you specify exact Phase 1 and Phase 2 algorithms, including AES256 encryption, SHA256 integrity, and DH Group 14. Policy-based traffic selectors influence which prefixes are advertised, but do not change cryptographic suites. Moving to active-active has no effect on algorithm selection, and switching to ExpressRoute eliminates the VPN altogether instead of securing it. Therefore, the correct first step is to define and assign a custom IPsec/IKE policy on the existing connection.