MetroPay has mission‑critical traffic and has ordered two ExpressRoute circuits from different providers: one at Equinix DC1 and one at an AT&T location DC2 in the same metro. They want to ensure high availability if a peering location or provider router fails. What design will provide resilient connectivity to their Azure VNets?

This option provides the highest resilience by using two distinct ExpressRoute circuits from different providers and at different peering locations. This protects against failures of a single provider, a single peering location, or a single circuit. Connecting both circuits to the VNets and using BGP path preferences ensures that traffic can automatically fail over if the preferred path becomes unavailable. The other options are incorrect because: Ordering two circuits in the same peering rack still creates a single point of failure at that rack. Relying solely on a single high-capacity ExpressRoute circuit with a site-to-site VPN backup does not meet the requirement for two ExpressRoute circuits and introduces potential performance limitations during failover. Microsoft does not disallow dual active ExpressRoute circuits. Using VNet gateway active/standby is for internal Azure gateway resilience, not for external ExpressRoute circuit resilience. Advertising overlapping prefixes on multiple circuits without proper BGP control can lead to routing instability.