How Do You Connect Five Datacenters to Azure with Central Route and Firewall Management?
You have five datacenters across North America and Europe. You have an Azure subscription. You need to recommend a solution to provide connectivity between the datacenters and Azure. The solution must meet the following requirements: • Ensure that apps hosted in a datacenter can access the resources hosted in Azure and the other datacenters. • Ensure that apps hosted in Azure can access the resources hosted in the datacenters. • Support the central management of network routes. • Support the central management of firewall rules. • Minimize administrative effort. What should you include in the recommendation?
Community Insight
The question tests hybrid connectivity at scale with centralized route and firewall administration; the trap is choosing ExpressRoute or VPN Gateway because they provide connectivity but not global transit routing and firewall policy management on their own.
Azure Virtual WAN is the recommended hub-and-spoke networking service for connecting multiple datacenters to Azure and to each other while centralizing route and firewall management. This page explains why it satisfies all five requirements and why ExpressRoute, VPN Gateway, and Front Door fall short.
A common mistake is selecting ExpressRoute because it is the private, high-bandwidth link to Azure; ExpressRoute alone does not provide any-to-any datacenter-to-datacenter transit or centralized firewall rule management, so it fails the central management and minimal-effort requirements.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Virtual WAN provides a managed hub-and-spoke architecture that connects datacenters through ExpressRoute circuits or site-to-site VPN links into Azure virtual hubs. Those hubs provide transitive any-to-any routing, so applications in a datacenter can reach Azure resources and other datacenters, and Azure-hosted applications can reach the datacenters. Routing is centrally managed through Virtual WAN hub route tables and routing intent, while Azure Firewall Manager centrally manages firewall policies across the hubs. This directly satisfies the requirements for centralized route management, centralized firewall rules, and minimized administrative effort across five datacenters in North America and Europe.Why the Other Options Are Wrong
ExpressRoute provides a private connection between on-premises networks and Azure, but by itself it does not create datacenter-to-datacenter transit or centrally managed firewall rules; those would require customer-managed routing and NVAs. Azure VPN Gateway provides encrypted tunnels to a virtual network, but each gateway is scoped to a virtual network and does not deliver global hub-based transit routing or central firewall policy management without additional design. Azure Front Door is a global Layer 7 HTTP/HTTPS load balancer and CDN, not a private network connectivity service for datacenter-to-Azure or datacenter-to-datacenter traffic.Community Comment Notes
The available community comment focuses on eliminating Azure Front Door, with mesloth noting that "Azure Front Door does not provide connectivity between data center and cloud." That observation aligns with the analysis because Front Door operates at the application layer rather than providing the private hybrid connectivity required here. The comment does not debate Azure Virtual WAN, so the decisive reasoning remains the need for centralized transit routing and firewall policy management across all sites.Official Reference
Exam Strategy
When the stem lists multiple datacenters plus centralized route and firewall management, map those phrases to Virtual WAN hubs, hub routing, and Azure Firewall Manager. Do not stop at ExpressRoute or VPN Gateway merely because they are hybrid connectivity options; the requirement for any-to-any transit and centralized policy is the differentiator.
Frequently Asked Questions
Why is ExpressRoute alone not enough for five datacenters?
ExpressRoute gives private connectivity to Azure but does not by itself provide datacenter-to-datacenter transit routing or centralized firewall rule management. Those requirements point to Azure Virtual WAN hubs.
Does Azure Virtual WAN replace ExpressRoute or VPN Gateway?
No. Virtual WAN uses ExpressRoute circuits or site-to-site VPN connections to attach datacenters, then adds managed hubs, transitive routing, and centralized firewall policy.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →