A manufacturer will connect a plant router to an Azure virtual network over the public internet, terminating on an Azure VPN gateway. An ExpressRoute circuit exists in another region and will not be used. Which model is the plant path?
Select an answer to reveal the explanation.
Short Explanation
You can see that the plant sends traffic over the public internet to the Azure VPN gateway, forming native IPsec. The unused ExpressRoute circuit in another region does not carry this traffic.
Full Explanation
Native IPsec uses the public internet as its underlay and terminates the tunnel on the provider's VPN gateway. The plant router connects over the public internet to the Azure VPN gateway, so native IPsec is the plant's path, regardless of other circuits the manufacturer owns. Private connectivity through the unused ExpressRoute circuit is not the path: that circuit carries traffic only when traffic is routed onto it, and this design says it will not be used. A colocation cross-connect is a customer cable in a shared facility to the provider's router. The fact that Microsoft operates the VPN gateway in its own network does not turn the plant's internet tunnel into a cross-connect. Catalyst SD-WAN cloud connectivity requires an SD-WAN overlay and controllers; a router that could join an overlay later is still using standalone IPsec today. Exam caveat: some designs run IPsec over ExpressRoute to encrypt traffic on a private path, but this plant's underlay is the public internet. Practical check: verify that the plant's default or Azure route points to the tunnel toward the VPN gateway's public IP, and that the ExpressRoute circuit's private peering shows no traffic from the plant.