A clinic's MPLS carrier offers a handoff into Azure ExpressRoute private peering for the virtual networks. The carrier also sells internet access. The clinic must stay off the public internet. Which handoff should they use?
Select an answer to reveal the explanation.
Short Explanation
Stay on the private road the carrier is already offering. You take the MPLS handoff into ExpressRoute private peering for the virtual networks. Their internet product, even with IPsec, is the public path you were told not to use.
Full Explanation
The MPLS provider's handoff into ExpressRoute private peering keeps clinic traffic on the private WAN and carries virtual-network prefixes. That is the private-connectivity model and it stays off the public internet. The carrier's internet access plus IPsec to the Azure VPN gateway is native IPsec over the internet, which the clinic ruled out. Microsoft peering is for Microsoft public services, not for the virtual networks. A colocation cross-connect requires a cage the clinic does not occupy and is not the product the carrier is handing off. Exam caveat: private peering and Microsoft peering can exist on one circuit. Pick private peering for the virtual networks even if Microsoft peering is also present. Operational check: the virtual-network prefixes should arrive over the MPLS handoff, and the clinic internet edge should show no session for those prefixes.