How Do You Connect Five Datacenters to Azure with Central Route and Firewall Management?
Short answer
D Azure Virtual WAN provides hub-based any-to-any connectivity between datacenters and Azure plus centralized route and firewall policy management.
Question
You have an Azure subscription.
You need to recommend a solution to provide connectivity between the datacenters and Azure. The solution must meet the following requirements:
• Ensure that apps hosted in a datacenter can access the resources hosted in Azure and the other datacenters.
• Ensure that apps hosted in Azure can access the resources hosted in the datacenters.
• Support the central management of network routes.
• Support the central management of firewall rules.
• Minimize administrative effort.
What should you include in the recommendation?
Key Takeaways
The question tests hybrid connectivity at scale with centralized route and firewall administration; the trap is choosing ExpressRoute or VPN Gateway because they provide connectivity but not global transit routing and firewall policy management on their own.
Azure Virtual WAN is the recommended hub-and-spoke networking service for connecting multiple datacenters to Azure and to each other while centralizing route and firewall management. This page explains why it satisfies all five requirements and why ExpressRoute, VPN Gateway, and Front Door fall short.
Common mistake: A common mistake is selecting ExpressRoute because it is the private, high-bandwidth link to Azure; ExpressRoute alone does not provide any-to-any datacenter-to-datacenter transit or centralized firewall rule management, so it fails the central management and minimal-effort requirements.
Expert Analysis
Why the Answer Is Correct
Azure Virtual WAN provides a managed hub-and-spoke architecture that connects datacenters through ExpressRoute circuits or site-to-site VPN links into Azure virtual hubs. Those hubs provide transitive any-to-any routing, so applications in a datacenter can reach Azure resources and other datacenters, and Azure-hosted applications can reach the datacenters. Routing is centrally managed through Virtual WAN hub route tables and routing intent, while Azure Firewall Manager centrally manages firewall policies across the hubs. This directly satisfies the requirements for centralized route management, centralized firewall rules, and minimized administrative effort across five datacenters in North America and Europe.
Why the Other Options Are Wrong
ExpressRoute provides a private connection between on-premises networks and Azure, but by itself it does not create datacenter-to-datacenter transit or centrally managed firewall rules; those would require customer-managed routing and NVAs. Azure VPN Gateway provides encrypted tunnels to a virtual network, but each gateway is scoped to a virtual network and does not deliver global hub-based transit routing or central firewall policy management without additional design. Azure Front Door is a global Layer 7 HTTP/HTTPS load balancer and CDN, not a private network connectivity service for datacenter-to-Azure or datacenter-to-datacenter traffic.
Community Comment Notes
The available community comment focuses on eliminating Azure Front Door, with mesloth noting that "Azure Front Door does not provide connectivity between data center and cloud." That observation aligns with the analysis because Front Door operates at the application layer rather than providing the private hybrid connectivity required here. The comment does not debate Azure Virtual WAN, so the decisive reasoning remains the need for centralized transit routing and firewall policy management across all sites.
Official Reference
- https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about
- https://learn.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing
These links open the official vendor documentation in a new tab.
Exam Strategy
When the stem lists multiple datacenters plus centralized route and firewall management, map those phrases to Virtual WAN hubs, hub routing, and Azure Firewall Manager. Do not stop at ExpressRoute or VPN Gateway merely because they are hybrid connectivity options; the requirement for any-to-any transit and centralized policy is the differentiator.
Frequently Asked Questions
Why is ExpressRoute alone not enough for five datacenters?
Does Azure Virtual WAN replace ExpressRoute or VPN Gateway?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
mesloth 👍 1 Answered DAzure Front Door does not provide connectivity between data center and cloud
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →