Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure VPN Gateway for Encrypted Hybrid Connections
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise wants to establish a secure connection between its on-premises corporate network and an Azure Virtual Network. The company has defined the following technical requirements:
- Connect the on-premises network to Azure using an encrypted tunnel over the public internet.
- Maintain low operational setup overhead without requiring a dedicated private telecommunications circuit.
- Enable a site-to-site connection that treats Azure like an extension of existing branch office infrastructure.
Which Azure networking service should the enterprise implement?
Explanations
Azure VPN Gateway
Azure VPN Gateway
What Azure VPN Gateway Is
Azure VPN Gateway is a specialized type of virtual network gateway that sends encrypted network traffic between an Azure Virtual Network and an on-premises location across the public internet. It functions as the cloud-side endpoint for encrypted virtual private network connections.
How It Meets the Requirements
- Encrypted Internet Connectivity: Azure VPN Gateway establishes an IPsec/IKE VPN tunnel across the public internet, encrypting all payload traffic in transit.
- No Dedicated Circuits Required: It utilizes standard broadband internet connections and existing edge routing equipment, avoiding the high costs and provisioning lead times of dedicated private lines.
- Branch Office Architecture: It enables Site-to-Site (S2S) topologies, effectively allowing the Azure cloud environment to operate like an extended corporate branch office within the broader organizational network.
Key Advantages and Capabilities
- Industry-Standard Protocols: Supports IKEv1 and IKEv2 with standard IPsec cryptographic suites.
- Flexible Architectures: Supports Site-to-Site, Point-to-Site, and VNet-to-VNet topologies.
- High Availability Options: Offers active-active gateway configurations and zone-redundant deployments.
- Cost Efficiency: Scales flexibly according to throughput requirements using distinct gateway SKUs without dedicated physical carrier contracts.
Why This Is Optimal
Azure VPN Gateway directly fulfills the enterprise's need for a secure, encrypted connection traversing the public internet while keeping infrastructure overhead and deployment complexity low.
Virtual Network Peering
Virtual Network Peering
What Virtual Network Peering Is
Virtual Network Peering (VNet peering) is a high-performance Azure networking feature that connects two or more Azure Virtual Networks directly to each other using the Microsoft backbone network.
Why It Doesn't Meet the Requirement
- Cloud-Only Scope: VNet peering links virtual networks within Azure (either within the same region or across regions via Global VNet Peering); it cannot connect directly to an on-premises physical datacenter or office network.
- Not an On-Premises Gateway: It does not establish encrypted IPsec tunnels across the public internet to physical routers or firewalls located in customer premises.
Key Characteristics and Limitations
- Zero Gateway Overhead: Peered VNets communicate directly via private IP addresses without routing through gateway devices.
- Low Latency & High Bandwidth: Delivers near-native network speeds powered by the Microsoft global backbone.
- Non-Overlapping CIDRs: Requires completely non-overlapping IP address spaces between the connected virtual networks.
This Answer Would Be Correct If
The organization needed to link two separate Azure virtual networks together within the cloud rather than connecting an on-premises office to Azure.
Azure ExpressRoute
Azure ExpressRoute
What Azure ExpressRoute Is
Azure ExpressRoute is a dedicated hybrid networking service that creates direct, private physical connections between an organization's on-premises infrastructure and the Microsoft Cloud via a connectivity provider.
Why It Doesn't Meet the Requirement
- Does Not Use the Public Internet: ExpressRoute traffic travels over a private connection provider's circuit and intentionally bypasses the public internet entirely.
- Requires Dedicated Circuits: Establishing an ExpressRoute connection requires contracting with an authorized ExpressRoute connectivity partner or exchange provider, which incurs higher costs and setup overhead.
- Unencrypted by Default: ExpressRoute connections are private but not encrypted by default, whereas the scenario specifically requested an encrypted tunnel across the public internet.
Key Characteristics and Limitations
- High Bandwidth and Low Latency: Offers bandwidth capacities up to 100 Gbps with consistent, deterministic latency.
- Enterprise Scale: Ideal for mission-critical enterprise workloads, big data migrations, and high-volume data replication.
- Complex Provisioning: Involves cross-connect provisioning, BGP routing configuration, and third-party telecom coordination.
This Answer Would Be Correct If
The organization required a high-speed, private, dedicated connection that bypasses the public internet entirely for ultra-low latency and predictable network performance.
Azure Private Endpoint
Azure Private Endpoint
What Azure Private Endpoint Is
Azure Private Endpoint is a network interface that assigns a private IP address from a virtual network subnet to a specific Azure Platform-as-a-Service (PaaS) resource, such as Azure Storage, Azure SQL Database, or Azure Key Vault.
Why It Doesn't Meet the Requirement
- Resource-Specific Interface: Private Endpoint connects virtual networks or clients to individual PaaS instances via Azure Private Link, rather than creating a site-to-site network bridge between entire corporate subnets.
- Not a Hybrid Network Gateway: It does not manage cross-premises routing tables, IPsec security associations, or site-to-site connectivity for general-purpose branch communication.
Key Characteristics and Limitations
- PaaS Isolation: Eliminates data exposure to the public internet by privately mapping specific PaaS services into a virtual network.
- Unidirectional Access: Secures incoming connections to the specific linked target resource without granting general network access.
- DNS Integration: Requires private DNS resolution to map service Fully Qualified Domain Names (FQDNs) to private IP addresses.
This Answer Would Be Correct If
The goal was to privately access a specific Azure PaaS service (such as an Azure Storage account or Azure SQL database) securely from within a virtual network without exposing public endpoints.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Network
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Network Subnets
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Virtual Network Peering
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private DNS
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Hybrid Cloud
Define cloud computing
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
Managed Identity for Azure DevOps Service Connections
Implement and manage Azure DevOps service connections and personalaccess tokens
Last updated Validated