They have a standard ExpressRoute circuit (not Direct) and still need network-layer encryption from the yard to the VNet. Which approach meets that need?
Select an answer to reveal the explanation.
Short Explanation
No Direct ports? You can’t lean on MACsec. Ride an IPsec VPN over ExpressRoute private peering—VPN gateway or Virtual WAN—so Layer 3 gets real encryption.
Full Explanation
On a standard (non-Direct) ExpressRoute circuit, network-layer encryption is commonly achieved by running a site-to-site IPsec VPN over ExpressRoute private peering using a VPN gateway or Virtual WAN—often called VPN over ExpressRoute. That meets the yard-to-VNet encryption need when MACsec on Direct ports is unavailable.
Enabling FastPath so encryption is included without additional gateways fails—FastPath does not add encryption. Turning on MACsec on provider-managed circuit ports the same way as ExpressRoute Direct fails for standard circuits. Relying solely on Azure Bastion JIT so ExpressRoute payloads are encrypted by Bastion fails by concept: Bastion brokers VM admin sessions, not ExpressRoute payload encryption.
Exam caveat: choose Direct+MACsec versus VPN-over-ExpressRoute based on circuit type and crypto requirements. Operational check: deploy VPN gateway or vWAN VPN, establish IPsec over the private peering path, verify encrypted tunnels, and test yard-to-VNet flows. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.