For a Site-to-Site VPN needing 1 Gbps at lowest cost, recommend the VpnGw2 SKU because VpnGw1 tops out at about 650 Mbps

AZ-500 By islever Editorial Last updated

Plan and implement security for virtual networks

Short answer

B Recommend VpnGw2: it delivers 1 Gbps S2S throughput at the lowest cost (VpnGw1 SKUs cap at ~650 Mbps).

Question

You have an on-premises network. You have an Azure subscription that contains the resources shown in the following table. You plan to deploy a Site-to-Site (S2S) VPN between the on-premises network and VNet1. You need to recommend an Azure VPN Gateway SKU that meets the following requirements: • Supports 1-Gbps throughput • Minimizes costs What should you recommend? - Exhibit: For a Site-to-Site VPN needing 1 Gbps at lowest cost, recommend the
  1. VpnGw1
  2. VpnGw2 Correct Answer
  3. VpnGw1AZ
  4. VpnGw2AZ

Key Takeaways

The 1-Gbps requirement is the deciding constraint: it rules out both VpnGw1 SKUs. Between the two 1-Gbps SKUs, minimize cost selects VpnGw2 over VpnGw2AZ (zone redundancy adds cost without raising the throughput needed here).

A Site-to-Site VPN must sustain 1 Gbps while minimizing cost. VpnGw1 (and the zone-redundant VpnGw1AZ) max out near 650 Mbps, which does not meet the 1-Gbps requirement. VpnGw2 delivers 1 Gbps and is cheaper than VpnGw2AZ, so VpnGw2 is the cost-optimal SKU that satisfies throughput.

Common mistake: Candidates pick VpnGw1 to save money, but it cannot meet 1 Gbps; others pick VpnGw2AZ for redundancy, which exceeds the requirement and costs more than necessary.

Expert Analysis

Why the Answer Is Correct

The requirement is 1-Gbps S2S throughput at the lowest cost. VpnGw1 and VpnGw1AZ support only about 650 Mbps, so they fail the throughput bar. VpnGw2 provides 1 Gbps, and VpnGw2AZ also provides 1 Gbps but adds zone redundancy at higher cost. To minimize cost while meeting 1 Gbps, VpnGw2 is the correct recommendation. (Option B)

Why the Other Options Are Wrong

  • Option A (VpnGw1) and Option C (VpnGw1AZ) both cap near 650 Mbps and cannot satisfy the 1-Gbps requirement.
  • Option D (VpnGw2AZ) meets 1 Gbps but costs more than VpnGw2; the question asks to minimize cost, so the non-AZ VpnGw2 is preferred.

Community Comment Notes

Comments confirmed B and cited the VPN Gateway pricing/SKU docs: 'VpnGw2 supports 1 Gbps, while Gw1 only 650 Mbps.' The resource table in the question is incidental; the throughput constraint alone determines the SKU.

Official Reference

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. obaemf 👍 2 Answered B
    https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/
  2. xRiot007 👍 1
    Correct. VpnGw2 supports 1 Gbps, while Gw1 only 650 Mbps. Ref: https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/
  3. randy0077 👍 1 Answered B
    https://azure.microsoft.com/en-us/pricing/details/vpn-gateway/#:~:text=VpnGw2,hour%20per%20connection

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Entra Permissions Management Highly Privileged Roles

S-grade

Restricting AKS API server access to specific networks is done with authorized IP address ranges

S-grade

Cross-tenant access settings for B2B collaboration apply only to Microsoft Entra ID tenants, not to Google or Microsoft accounts

S-grade

Creating an allow list of a partner's cloud apps for your users is configured via Outbound access settings in Cross-tenant access settings

S-grade

← Back to AZ-500 Study Guide