A regulated workload uses ExpressRoute but requires end-to-end confidentiality for application traffic. Which two statements guide the design? Select 2 answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.ExpressRoute private connectivity is not end-to-end encrypted by default
B.Use BGP route announcements as payload encryption
C.Use application TLS or a supported IPsec-over-ExpressRoute design according to the required scope
D.Treat ExpressRoute Direct MACsec as encryption of the entire application journey
E.Assume redundant circuits encrypt every application packet automatically

Show the answer and explanation

✓ Correct answers

ExpressRoute private connectivity is not end-to-end encrypted by default
Use application TLS or a supported IPsec-over-ExpressRoute design according to the required scope

Private transport and encryption are separate requirements. TLS and supported IPsec can protect the required traffic scope; redundant connections improve availability without encrypting payloads, MACsec covers the supported physical-link segment, and BGP exchanges routes rather than encrypting application content. Source guide: PDF page(s) 56-57.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.