AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A point-to-site VPN configuration for each user laptop.

  Why it's wrong here

  Point-to-site (P2S) VPN is designed for individual client devices, such as laptops or smartphones, to connect one at a time to an Azure VNet using protocols like OpenVPN or IKEv2. At a branch office with a shared edge device and many users, this would require installing and managing a separate VPN client on every laptop and would consume one concurrent client connection per user, which is operationally inefficient and hits gateway connection limits. Moreover, it completely bypasses the branch's static public IP and edge firewall, whereas a site-to-site VPN uses that public IP to terminate a single IPsec tunnel for all branch users, making S2S the architecturally appropriate choice.

  When this WOULD be correct

  A point-to-site VPN would be correct in a scenario where remote employees need to connect from individual laptops (e.g., home offices or traveling users) to access Azure VMs, and there is no branch office with a static public IP edge device.

• ✓

  A site-to-site VPN gateway connection.

  Why this is correct

  Site-to-site VPN is the standard option for connecting an on-premises branch network to Azure through a VPN device or edge appliance. It uses the branch's static public IP, encrypts traffic over the internet, and allows users on the branch network to reach private Azure resources such as VMs inside the VNet.

• ✗

  A private endpoint to each virtual machine in Azure.

  Why it's wrong here

  A private endpoint is a network interface with a private IP address inside your VNet that exposes an Azure PaaS service, such as Azure Storage or Azure SQL, via Azure Private Link. It cannot be attached to a virtual machine as a connection target because VMs already have private IPs and are not offered as a Private Link service unless you explicitly publish your own service. Even if you configured a private endpoint for the VNet, it would not establish any encrypted tunnel or route between the branch office and Azure, so users would still have no secure path to reach the VMs over the internet.

  When this WOULD be correct

  A question asks: 'An organization needs to securely access an Azure Storage account from on-premises without using the public internet. Which solution should be deployed?' In that scenario, a private endpoint would be correct.

• ✗

  VNet peering between the branch and Azure.

  Why it's wrong here

  VNet peering is an Azure-only mechanism that connects two Azure virtual networks over the Microsoft backbone, allowing private IP traffic between them regardless of region or subscription. A branch office network on-premises is not a virtual network and cannot be peered with an Azure VNet; peering has no concept of a public IP edge device or IPsec encryption. To connect a branch office, you must use an Azure VPN gateway or ExpressRoute, so VNet peering is fundamentally incapable of providing the required hybrid connectivity.

  When this WOULD be correct

  VNet peering is correct when you need to connect two virtual networks in Azure (same or different regions) to enable private IP communication between resources, such as linking a hub VNet to a spoke VNet without traversing the internet.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question