Virtual Network Gateways Required for ExpressRoute and Virtual WAN?
Your company has multiple branch offices across North America. You have an Azure subscription. The subscription contains three virtual networks in the US East Azure region that have a hub-and-spoke topology. The hub network contains an Azure VPN gateway that provides Site-to-Site (S2S) and Point-to-Site (P2S) VPN connectivity for the branch offices and remote users. You need to implement ExpressRoute and migrate the hub-and-spoke topology to Azure Virtual WAN. The solution must provide fully meshed connectivity for the following network traffic: • Traffic from a branch office via ExpressRoute to the other branch offices and the virtual networks • Traffic from a branch office via the S2S VPN to the other branch offices and the virtual networks • Traffic from the remote users via the S2S VPN to the branch offices and the virtual networks • Traffic from the virtual networks to the branch offices • Traffic between the virtual networks How many virtual network gateways are required?
Community Insight
This question tests whether you know Azure Virtual WAN uses managed hub gateways rather than customer-deployed virtual network gateways, and the trap is counting one gateway per connectivity type or per virtual network.
Migrating a hub-and-spoke topology to Azure Virtual WAN with ExpressRoute, S2S VPN, and P2S connectivity changes how gateways are deployed. The correct count is zero virtual network gateways because Virtual WAN hubs provide managed VPN, ExpressRoute, and user VPN gateways.
A common mistake is selecting 3, assuming separate gateways are needed for ExpressRoute, S2S VPN, and P2S VPN, or selecting 1 because the existing hub VNet had a VPN gateway. Both overlook that Virtual WAN hub gateways are managed and are not virtual network gateways.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Virtual WAN provides a managed Virtual Hub that includes built-in gateways for site-to-site VPN, ExpressRoute, and point-to-site/user VPN. These are Virtual WAN hub gateways, not virtual network gateways deployed into a customer VNet. The branch offices can connect through the ExpressRoute gateway and the S2S VPN gateway, remote users through the user VPN gateway, and the virtual networks through Virtual WAN VNet connections. Because the hub handles routing between all of these connections, the fully meshed connectivity requirement is met without deploying any virtual network gateways. Therefore, the required number of virtual network gateways is 0.Why the Other Options Are Wrong
Option B, 1, would imply a traditional hub VNet with a single gateway, but a single virtual network gateway cannot simultaneously provide ExpressRoute, S2S VPN, and P2S VPN in the same VNet, and Virtual WAN replaces that model entirely. Option C, 2, matches a legacy design with one VPN gateway and one ExpressRoute gateway in the hub VNet, but those are not virtual network gateways in a Virtual WAN architecture. Option D, 3, likely assumes one gateway per connectivity type or one per virtual network, which overcounts because the Virtual WAN hub gateways are managed resources and the spoke VNets do not need their own gateways.Community Comment Notes
As gpais noted, "Azure Virtual WAN utilizes a managed component called a Virtual Hub" and within a Virtual Hub you provision built-in, fully managed hub-specific gateways such as a VPN Gateway, an ExpressRoute Gateway, and a User VPN Gateway. That comment directly supports the zero count because the gateways exist inside the managed Virtual WAN hub rather than as virtual network gateways. The comment also reinforces that the migration path is to use Virtual WAN hub gateways instead of redeploying the old hub VNet VPN gateway.Official Reference
Exam Strategy
When a question asks how many virtual network gateways are needed after a migration to Azure Virtual WAN, separate the managed Virtual WAN hub gateways from customer-deployed VNet gateways. If the architecture is Virtual WAN hubs with ExpressRoute, S2S VPN, and P2S VPN, the virtual network gateway count is usually zero unless the question explicitly asks about legacy hub VNet gateways.
Frequently Asked Questions
Why does Azure Virtual WAN require zero virtual network gateways here?
Virtual WAN hubs include managed S2S VPN, ExpressRoute, and user VPN gateways, so the spoke VNets do not need their own virtual network gateways for this connectivity.
Does the existing hub VNet VPN gateway remain after migrating to Virtual WAN?
No. The migration replaces the hub VNet gateway role with Virtual WAN hub gateways, while the VNets connect to the Virtual WAN hub through VNet connections.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →