A botanical garden needs the whole on-premises yard always connected to Azure, and a few traveling inspectors also need laptop tunnels. How should the security engineer split the VPN patterns?
Select an answer to reveal the explanation.
Short Explanation
Yard stays planted—site-to-site. Inspectors roam—point-to-site. Don’t make one VPN pattern do both jobs or invent peering to kitchen routers.
Full Explanation
Site-to-site VPN provides continuous connectivity between an on-premises network and Azure, while point-to-site serves individual remote clients. For a botanical garden that needs the whole yard always connected plus traveling inspectors on laptops, use site-to-site for the always-on yard and point-to-site for the inspectors’ laptops.
Using only point-to-site for the yard and inspectors fails operationally for an always-on site network. Using only site-to-site and forcing inspectors to RDP through a yard workstation creates a brittle jump path and does not give laptop tunnels. Peering the yard VNet to every inspector home router fails by concept: VNet peering is not for home routers.
Exam caveat: S2S and P2S solve different problems and often coexist on the same gateway design. Operational check: establish S2S to the yard, configure P2S for inspectors, test both paths, and document which workloads use which pattern. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.