AZ-104 Implement and Manage Virtual Networking Practice Question
A company has 25 remote employees who need to connect from their laptops to Azure VMs that have only private IP addresses. No on-premises VPN appliance exists, and the VMs must not be assigned public IP addresses. Which solution should the administrator deploy?
⚠ Common exam trap
It's easy for candidates to confuse Point-to-Site with Site-to-Site VPN, assuming a Site-to-Site VPN can work without an on-premises VPN appliance, or they mistakenly think a public load balancer can provide private access without public IPs on the VMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Point-to-site VPN Gateway
A Point-to-Site (P2S) VPN Gateway is the correct solution because it allows individual remote clients (laptops) to establish a secure VPN connection from anywhere to Azure VMs with private IP addresses, without requiring a public IP on the VMs or an on-premises VPN appliance. P2S uses SSTP, IKEv2, or OpenVPN protocols to create a tunnel from each client to the Azure virtual network, enabling access to private resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Site-to-site VPN Gateway
Why it's wrong here
A site-to-site VPN Gateway is intended for connecting an entire on-premises network to Azure, and it requires a VPN device or gateway on the remote side. Since the 25 remote employees are individual laptops at various locations, there is no dedicated local VPN device for each user, and forcing each laptop to act as a site would be impractical. While site-to-site provides a stable connection, it does not fit the scenario of scattered, individual mobile clients.
When this WOULD be correct
A company has an on-premises network with a VPN appliance and needs to connect that entire network to Azure VNet securely. All on-premises users and devices need access to Azure resources.
- ✓
Point-to-site VPN Gateway
Why this is correct
Point-to-site VPN Gateway is the correct choice because it allows each remote employee's laptop to establish an individual encrypted tunnel (using SSTP, IKEv2, or OpenVPN) directly to the Azure virtual network. This approach does not expose the VMs to the public internet, as the VMs remain reachable only through the VPN gateway's private address space. It supports modern authentication methods like Azure AD, certificate-based, or RADIUS, making it ideal for a distributed set of 25 remote users without requiring any on-premises hardware.
- ✗
ExpressRoute circuit
Why it's wrong here
ExpressRoute provides a dedicated, private, high-bandwidth connection from an on-premises network to Azure, but it requires physical cabling through a service provider or colocation facility, which is not feasible for individual remote laptops. Setting up ExpressRoute involves significant cost, lead time, and network engineering, making it an overkill and unsuitable solution for only 25 distributed users. ExpressRoute is designed for enterprise branch or data center connectivity, not for per-user remote access.
When this WOULD be correct
A company has a large on-premises data center with multiple servers that need high-speed, low-latency, and reliable connectivity to Azure VMs, and the company can establish a dedicated circuit through a connectivity provider. The scenario requires consistent performance and compliance with regulatory data residency requirements.
- ✗
Public load balancer with inbound NAT rules
Why it's wrong here
A public load balancer with inbound NAT rules is designed to forward traffic from a public IP address to specific VMs, but this inherently makes those VMs reachable from the internet, which violates the requirement to keep VMs private-only. Additionally, inbound NAT rules simply remap ports and do not provide any encryption, authentication, or identity-based access control for remote users. This solution is meant for exposing services, not for creating secure, user-specific connectivity to a private virtual network.
When this WOULD be correct
This option would be correct if the question required load-balancing incoming internet traffic to multiple VMs (with private IPs) behind a single public endpoint, and the VMs could have public IPs or the load balancer could translate traffic to private IPs via NAT rules.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Point-to-site VPN GatewayCorrect answer▾
Why this is correct
Point-to-site VPN Gateway is the correct choice because it allows each remote employee's laptop to establish an individual encrypted tunnel (using SSTP, IKEv2, or OpenVPN) directly to the Azure virtual network. This approach does not expose the VMs to the public internet, as the VMs remain reachable only through the VPN gateway's private address space. It supports modern authentication methods like Azure AD, certificate-based, or RADIUS, making it ideal for a distributed set of 25 remote users without requiring any on-premises hardware.
✗Site-to-site VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Site-to-site VPN requires a VPN device on-premises, which the company does not have. It connects entire networks, not individual remote clients.
★ When this WOULD be the correct answer
A company has an on-premises network with a VPN appliance and needs to connect that entire network to Azure VNet securely. All on-premises users and devices need access to Azure resources.
Why candidates choose this
Candidates may confuse site-to-site with point-to-site, or think that any VPN can connect remote users, overlooking the requirement for an on-premises VPN device.
✗ExpressRoute circuitWrong answer — click to see why▾
Why this is wrong here
ExpressRoute provides dedicated private connectivity to Azure from an on-premises network, but requires a physical connection or a partner provider, and does not support individual remote client connections without a VPN gateway. The question specifies no on-premises VPN appliance and remote employees connecting from laptops, making ExpressRoute unsuitable.
★ When this WOULD be the correct answer
A company has a large on-premises data center with multiple servers that need high-speed, low-latency, and reliable connectivity to Azure VMs, and the company can establish a dedicated circuit through a connectivity provider. The scenario requires consistent performance and compliance with regulatory data residency requirements.
Why candidates choose this
Candidates may think ExpressRoute is the most secure and private option for connecting to Azure VMs, overlooking that it is designed for site-to-site connectivity and requires on-premises infrastructure, not for individual remote client access.
✗Public load balancer with inbound NAT rulesWrong answer — click to see why▾
Why this is wrong here
A public load balancer with inbound NAT rules requires VMs to have public IP addresses or be reachable via a public frontend, which contradicts the requirement that VMs must not be assigned public IP addresses. Additionally, it does not provide a VPN tunnel for secure remote connectivity.
★ When this WOULD be the correct answer
This option would be correct if the question required load-balancing incoming internet traffic to multiple VMs (with private IPs) behind a single public endpoint, and the VMs could have public IPs or the load balancer could translate traffic to private IPs via NAT rules.
Why candidates choose this
Candidates might think inbound NAT rules can map public ports to private VMs, providing remote access without public IPs on VMs, but they overlook that the load balancer's frontend is public and the VMs still need outbound connectivity or a VPN for security.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
VPN Gateway
A VPN Gateway is a network device or service that creates an encrypted tunnel between two or more networks over the internet, allowing secure communication.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.