A hospital already uses an MPLS WAN and wants private access to Azure virtual networks, with the carrier handing the network off into ExpressRoute. Which model is this?
Select an answer to reveal the explanation.
Short Explanation
The carrier already has the private road. You stay on it and let them hand you into ExpressRoute private peering for the virtual networks. You do not jump off onto their internet on-ramp, and you do not use the peering that is built for Microsoft's public services.
Full Explanation
When the MPLS provider extends the private WAN into Azure ExpressRoute, the hospital traffic stays off the public internet. Private peering is the ExpressRoute peering that carries virtual-network prefixes, so this is the private-connectivity model through an MPLS provider. Using that carrier's internet access and then building IPsec to an Azure VPN gateway is the internet native-IPsec model. The MPLS cloud handoff is no longer on the path. Microsoft peering exchanges routes for Microsoft public services such as Microsoft 365. It is not the peering that attaches the hospital to its virtual networks. A cross-connect the customer orders in a meet-me room is the colocation model. The hospital is not ordering that cross-connect. The carrier is providing the handoff. Exam caveat: one ExpressRoute circuit can carry private peering and Microsoft peering at the same time. The peering you choose still has to match the prefixes you need. Operational check: on the ExpressRoute circuit, confirm private peering is provisioned and that the virtual-network prefixes are learned over that peering rather than over the VPN gateway.