Case Study 3 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The Montreal office has 2,000 employees…

To connect the New York office to Azure using a site-to-site VPN, you must configure a virtual network gateway and a local network gateway in Azure, and a site-to-site VPN connection on the New York office's firewall.

Submitted by minji_kr· Mar 4, 2026Manage identities and governance

Question

Case Study 3 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has 200 employees. All the resources used by Contoso are hosted on-premises. Contoso creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses adomain named contoso.onmicrosoft.com. The tenant uses the P1 pricing tier. Existing Environment The network contains an Active Directory forest named contoso.com. All domain controllers are configured as DNS servers and host the contoso.com DNS zone. Contoso has finance, human resources, sales, research, and information technology departments. Each department has an organizational unit (OU) that contains all the accounts of that respective department. All the user accounts have the department attribute set to their respective department. New users are added frequently. Contoso.com contains a user named User1. All the offices connect by using private links. Contoso has data centers in the Montreal and Seattle offices. Each data center has a firewall that can be configured as a VPN device. All infrastructure servers are virtualized. The virtualization environment contains the servers in the following table. Contoso uses two web applications named App1 and App2. Each instance on each web application requires 1GB of memory. The Azure subscription contains the resources in the following table. The network security team implements several network security groups (NSGs). Planned Changes Contoso plans to implement the following changes: - Deploy Azure ExpressRoute to the Montreal office. - Migrate the virtual machines hosted on Server1 and Server2 to Azure. - Synchronize on-premises Active Directory to Azure Active Directory (Azure AD). - Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2. Technical requirements Contoso must meet the following technical requirements: - Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up to five instances. - Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office. - Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal office. - Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department only. - Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.contoso.com - Connect the New York office to VNet1 over the Internet by using an encrypted connection. - Create a workflow to send an email message when the settings of VM4 are modified. - Create a custom Azure role named Role1 that is based on the Reader role. - Minimize costs whenever possible. Hotspot Question You need to meet the connection requirements for the New York office. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

From the Azure portal:
Create an ExpressRoute circuit only.Create a virtual network gateway only.Create a virtual network gateway and a local network gateway.Create an ExpressRoute circuit and an on-premises data gateway.Create a virtual network gateway and an on-premises data gateway.
In the New York office:
Deploy ExpressRoute.Deploy a DirectAccess server.Implement a Web Application Proxy.Configure a site-to-site VPN connection.

Explanation

Approach. The case study indicates that the New York office needs to connect to Azure, and states that on-premises firewalls 'can be configured as a VPN device'. The accompanying network diagram explicitly illustrates a site-to-site VPN connection between an on-premises network and an Azure Virtual Network.

Therefore, to establish this connectivity:

From the Azure portal: You must create two main components for a site-to-site VPN. A Virtual Network Gateway acts as the VPN concentrator in Azure for the Virtual Network. A Local Network Gateway represents the on-premises VPN device and its network configuration to Azure. The option 'Create a virtual network gateway and a local network gateway' is the correct choice, as it provides both necessary Azure resources.
In the New York office: Given that firewalls can be configured as VPN devices and a site-to-site VPN is being established, the appropriate action is to 'Configure a site-to-site VPN connection' on the on-premises VPN device (firewall). This involves setting up the IPSec tunnel parameters to connect to the Azure Virtual Network Gateway.

Common mistakes.

common_mistake. 1. Choosing ExpressRoute options: While ExpressRoute provides a dedicated private connection, the case study's mention of 'firewall that can be configured as a VPN device' and the explicit VPN diagram strongly suggest a VPN solution, which is typically more cost-effective and faster to implement for initial connectivity compared to ExpressRoute. ExpressRoute circuits also require a connectivity provider, which isn't explicitly mentioned as being utilized for the New York office's Azure connection.

'Create a virtual network gateway only': This is insufficient for a site-to-site VPN, as the Local Network Gateway is required to define the on-premises VPN device and its IP ranges to Azure.
Including 'on-premises data gateway': An on-premises data gateway is used for specific services (like Power BI, Logic Apps) to securely access on-premises data sources. It is not a component for establishing general network connectivity or an IPSec VPN tunnel between networks.
'Deploy a DirectAccess server': DirectAccess is a Windows Server feature for remote users to access internal network resources without a VPN client. It's for individual client connectivity, not for connecting an entire branch office network to Azure.
'Implement a Web Application Proxy': Web Application Proxy is used to publish internal web applications to external users, providing a reverse proxy for secure access. It does not establish network-level connectivity between an on-premises network and an Azure VNet.

Concept tested. Establishing hybrid cloud connectivity between an on-premises network and an Azure Virtual Network using a Site-to-Site VPN. This includes understanding the required Azure resources (Virtual Network Gateway, Local Network Gateway) and the on-premises configuration (VPN device capabilities and setup). It also tests the ability to differentiate between various Azure and on-premises connectivity solutions.

Topics

#Azure AD Connect#Hybrid Identity#Azure AD P1 features#Directory Synchronization

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice