You plan to enable BGP for a Site-to-Site VPN between your datacenter and Azure. Which two Azure resources must you configure to support this BGP-enabled connection? (Choose two.)

A virtual network gateway is essential as it provides the IPsec VPN endpoint in Azure, allowing your Azure VNet to connect to your on-premises network. A local network gateway represents your on-premises VPN device and its network configuration to Azure, including its public IP address and the address spaces behind it. Both are fundamental components for establishing a Site-to-Site VPN connection, especially when BGP is involved for dynamic routing. Azure Application Gateway, Azure Firewall, and Azure Front Door are all networking services, but they serve different purposes like load balancing, network security, and global traffic management, respectively, and are not directly involved in establishing the foundational Site-to-Site VPN tunnel with BGP.