A hospital must send a defined set of Microsoft public-service prefixes over ExpressRoute Microsoft peering, and must not send them across the public internet. Virtual-network traffic uses a different peering. Which model is the Microsoft public-service path?
Select an answer to reveal the explanation.
Short Explanation
Microsoft peering is the private door for the public Microsoft services it is built to carry, and private peering is a different door for virtual networks. You keep those prefixes on Microsoft peering so they stay off the public internet. A SIG that finishes the trip on the internet misses the requirement.
Full Explanation
ExpressRoute Microsoft peering exchanges routes for Microsoft public services. Using it for the defined set of prefixes the hospital is allowed to send that way is dedicated connectivity for those services, and it keeps them off the public internet. Private peering carries virtual-network prefixes. The stem already uses a different peering for that traffic, so private peering is the wrong door for these public-service prefixes. Direct internet access sends the clinics onto the public internet, which the requirement forbids. A secure internet gateway that delivers the prefixes over the public internet also fails the path constraint, even though it inspects the flow. Exam caveat: Microsoft does not put every Microsoft 365 flow on ExpressRoute. Only the prefixes this design is actually allowed to send on Microsoft peering belong there. Do not claim the peering carries the entire service. Operational check: those prefixes should be learned on Microsoft peering, and a clinic trace to one of them should not appear on the internet edge.