Northwind Logistics wants automatic failover to a site‑to‑site VPN if their ExpressRoute circuit fails. They already have an S2S VPN gateway (route‑based) with BGP and an ExpressRoute circuit. Which configuration will provide fastest and most reliable failover while preserving route propagation to VNets?

The correct option leverages BGP's dynamic routing capabilities for fast and reliable failover. By advertising the same on-premises prefixes over both ExpressRoute and the S2S VPN and manipulating BGP path attributes (like local preference or weight on the on-premises router), ExpressRoute can be preferred. When ExpressRoute fails, BGP automatically withdraws its routes, causing Azure to instantly switch traffic to the available VPN path. This preserves route propagation to VNets. The other options are less efficient or reliable: configuring primary/backup in the Azure portal for gateways doesn't apply to ExpressRoute/VPN coexistence for failover; static UDRs require manual intervention and don't scale; VNet peering failover policies are not designed for this specific cross-premises failover scenario.