Skip to main content

Technical Lab: Choose an appropriate scale unit for each gateway type

Questions​

Question 1 — Multiple Choice​

You are sizing a VPN Gateway to support site-to-site connections with an estimated aggregate throughput of 6.5 Gbps, with mandatory support for BGP and active-active routing. Which SKU meets this requirement with the lowest possible cost?

A) VpnGw3
B) VpnGw4
C) VpnGw5
D) VpnGw3AZ

Question 2 — Technical Scenario​

A team configured an ExpressRoute Gateway with SKU Standard in a VNet that needs to support the FastPath feature, in order to eliminate the latency introduced by the gateway in the data path. After configuration, FastPath is not being activated. What is the most likely cause?

A) The Standard SKU does not support BGP, preventing FastPath from being negotiated
B) FastPath requires the ExpressRoute circuit to be of type Local, incompatible with the Standard SKU
C) FastPath is only supported on ErGw3AZ and Ultra Performance SKUs, and Standard is not eligible
D) FastPath requires the VNet to have at least two gateway subnets active simultaneously

Question 3 — True or False​

A Virtual WAN Hub with VPN gateway configured at 1 scale unit supports up to 500 Mbps of aggregate throughput and up to 500 simultaneous tunnel connections from branch sites.

Question 4 — Technical Scenario​

Your organization operates a hub-and-spoke topology with Virtual WAN. The central hub needs to support 10 Gbps traffic between branches and Azure resources, plus at least 30 simultaneous site-to-site VPN connections. The architect proposed configuring the hub VPN gateway with 2 scale units. Analyze the planning excerpt below:

Hub VPN Gateway:
  Scale Units : 2
  Expected throughput : ~1 Gbps
  Max S2S tunnels     : 30
  Routing preference  : Microsoft network

What critical problem does this configuration present in relation to the throughput requirement?

A) The number of scale units only defines the number of tunnels, with no impact on throughput
B) 2 scale units deliver approximately 1 Gbps, insufficient for the 10 Gbps requirement
C) Virtual WAN does not scale by scale units for VPN, but by independent gateway instances
D) 2 scale units are sufficient for 10 Gbps, as each unit equals 5 Gbps in Virtual WAN

Question 5 — Multiple Choice​

When comparing ExpressRoute Gateway SKUs, which of the following statements correctly describes a functional difference between ErGw1AZ and ErGw3AZ, beyond the throughput difference?

A) Only ErGw3AZ supports connections with ExpressRoute circuits of type Premium
B) Only ErGw3AZ supports the FastPath feature, which bypasses the gateway in the data path for qualified flows
C) Only ErGw3AZ supports coexistence with VPN Gateway in the same VNet
D) Only ErGw3AZ supports availability zone redundancy, while ErGw1AZ is single-zone

Answer Key and Explanations​

Answer Key — Question 1​

Answer: B

The VpnGw4 SKU offers aggregate throughput of up to 10 Gbps, supports BGP and active-active mode, being the smallest SKU capable of exceeding the 6.5 Gbps requirement. The VpnGw3 delivers up to 5 Gbps, falling short of the requirement. The VpnGw5 would also meet the requirement, but the question demands the lowest possible cost, making it unnecessary. The VpnGw3AZ is the zone-redundant variant of VpnGw3 and maintains the same 5 Gbps ceiling. The distinction between base SKU and AZ variant does not increase throughput; the AZ designation indicates zone resilience, not additional capacity.

Answer Key — Question 2​

Answer: C

The FastPath feature in ExpressRoute Gateway aims for data packets to travel directly between the on-premises network and VNet VMs, without passing through the gateway. This feature is only available on Ultra Performance and ErGw3AZ SKUs. The Standard SKU does not support FastPath, regardless of any additional configuration. Distractor A is incorrect because the Standard SKU supports BGP normally. Distractor B confuses circuit type with gateway capability, and distractor D invents a non-existent requirement about multiple subnets.

Answer Key — Question 3​

False

A scale unit in a Virtual WAN Hub VPN gateway delivers 500 Mbps of throughput. However, the maximum number of site-to-site tunnel connections associated with 1 scale unit is 500 tunnels only from certain configurations, but the statement correctly combines throughput with a number of tunnels that varies according to official documentation. The critical point that makes the statement false is that 1 scale unit supports 500 Mbps, not 500 Mbps with 500 tunnels as a guaranteed indivisible unit. In practice, the number of tunnels scales separately from throughput and can be expanded independently, making the statement technically imprecise by treating both limits as a fixed pair tied to 1 scale unit.

Answer Key — Question 4​

Answer: B

In Virtual WAN, each VPN gateway scale unit equals 500 Mbps of aggregate throughput. With 2 scale units, the gateway delivers approximately 1 Gbps, far short of the 10 Gbps requirement. To achieve 10 Gbps, it would be necessary to configure 20 scale units. Distractor A is incorrect because scale units directly impact throughput. Distractor C is incorrect as Virtual WAN uses exactly the scale unit model for VPN. Distractor D inverts the actual proportion, erroneously suggesting each unit is worth 5 Gbps.

Answer Key — Question 5​

Answer: B

The most relevant functional difference between ErGw1AZ and ErGw3AZ, beyond throughput capacity, is support for FastPath. This feature is only available on ErGw3AZ (and Ultra Performance), allowing data traffic to bypass the gateway and reach VMs directly, reducing latency. Distractor A is incorrect because both SKUs support Premium circuits. Distractor C is incorrect as coexistence with VPN Gateway is determined by VNet topology, not exclusively by ExpressRoute Gateway SKU. Distractor D is incorrect because both SKUs have "AZ" in the name, which indicates availability zone support in both cases.