Which two actions should you perform?

You implement Microsoft Azure ExpressRoute.
You need to ensure that if the ExpressRoute connection is unavailable, you can manage the resources in Azure over a secure connection.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Create an Azure virtual network.
B. Enable a point-to-site VPN on the gateway.
C. Install the Azure VPN client.
D. Create a certificate.
E. Create a private IP address.