You plan to configure BGP for a Site-to-Site VPN connection between a datacenter and Azure. Which two Azure resources should you configure? Each correct answer presents a part of the solution. (Choose two.) NOTE: Each correct selection is worth one point.

To configure a Site-to-Site (S2S) VPN with BGP in Azure, two fundamental resources must be configured. The virtual network gateway is the VPN endpoint in Azure. BGP must be enabled on this gateway, and it is configured with an Azure Autonomous System Number (ASN). The local network gateway is an Azure resource that represents the on-premises VPN device and network. This resource holds the public IP of the on-premises device, the on-premises network address prefixes, and, critically for this scenario, the on-premises BGP peer IP address and ASN. Both resources are essential for establishing the connection and enabling dynamic route exchange via BGP.

B. Azure Application Gateway is a Layer 7 web traffic load balancer and is not involved in establishing network-level S2S VPN connections.

C. Azure Firewall is a network security service. While it can be used to inspect traffic, it is not a core component required to configure the BGP VPN connection itself.

E. Azure Front Door is a global application delivery and acceleration service that operates at the application layer, not the network layer required for S2S VPNs.

1. Microsoft Learn

Official Documentation. "About BGP with Azure VPN Gateway". In the "BGP configuration steps" section

the documentation explicitly outlines the two main steps: 1. "Enable BGP on your Azure VPN gateway..." and 2. "Create a Local Network Gateway with BGP parameters to represent your on-premises network." This confirms that both a virtual network gateway and a local network gateway are required.

2. Microsoft Learn

Official Documentation. "Configure BGP for a site-to-site VPN connection using the Azure portal". This tutorial is structured into two main parts for configuration: "Part 1: Configure BGP on the virtual network gateway" and "Part 2: Configure BGP on the local network gateway"

demonstrating that both resources are integral to the solution.

3. Microsoft Learn

Official Documentation. "Azure VPN Gateway FAQ". Under the "BGP" section

the FAQ "Do I need to assign an ASN to my local network gateway?" is answered with "You need to assign an ASN to your local network gateway only if you're using BGP to advertise routes to that on-premises site." This directly links the local network gateway to the BGP configuration.