A retailer must keep an internet IPsec path into an Azure virtual network up through a gateway-instance failure, without waiting for a standby instance to claim one public address. Which design meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
A spare engine that starts only after the first one dies still leaves you coasting. You want both engines already turning. On Azure, that is an active-active route-based gateway with a live tunnel to each public IP, not a single Basic policy-based tunnel.
Full Explanation
In an Azure active-active VPN gateway, each instance has its own public IP and builds its own IPsec tunnel to the on-premises router. Traffic can use either tunnel, so the failure of one instance does not wait on a standby promotion. The gateway must be route-based. A policy-based Basic gateway supports one site-to-site tunnel, does not run active-active, and does not meet the failure case. An active-standby route-based gateway does fail over, but the standby has to take over and Microsoft documents a brief interruption while that happens, which is the delay the retailer ruled out. A second static route toward the same public IP adds no second instance and no second tunnel. If that one address goes away, both routes fail together. Exam caveat: active-active can send a flow out one tunnel and back the other, so a firewall that demands symmetric paths needs BGP tuning or active-standby instead. Operational check: confirm two public IPs on the gateway and two IPsec security associations on the store router, one to each address.