AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A site-to-site connection using Azure VPN Gateway.

  Why this is correct

  A site-to-site VPN with Azure VPN Gateway is designed for permanent encrypted connectivity between an on-premises network and an Azure VNet. The branch firewall can establish an IPsec/IKE tunnel to the gateway using its public IP, which matches the scenario. This approach provides private connectivity across the internet without exposing the workload directly to public endpoints. It is the standard choice for hybrid network connectivity when ExpressRoute is not required.

• ✗

  VNet peering between the branch office and the Azure VNet.

  Why it's wrong here

  VNet peering connects two Azure virtual networks, enabling private IP traffic between them without any VPN tunnel. The branch office's on-premises firewall is not a virtual network and cannot participate in peering, nor does peering create any encrypted link across the internet. Peering is also non-transitive for indirect connectivity, so you still need a gateway to reach on-premises resources. Thus it is purely a cloud-to-cloud networking mechanism, not a hybrid connectivity option.

  When this WOULD be correct

  When connecting two Azure VNets in the same region or across regions for private, low-latency communication, VNet peering is the correct solution. For example, linking a hub VNet to a spoke VNet.

• ✗

  Azure Bastion in the target VNet.

  Why it's wrong here

  Azure Bastion is a fully managed PaaS service that provides secure, browser-based RDP and SSH sessions to individual virtual machines in a VNet, eliminating public IP exposure on those VMs. It does not create any IPsec tunnel, route traffic from the office's entire network, or connect the on-premises firewall to Azure. Bastion only carries interactive management sessions and requires the VNet to already have some network path from the client; it cannot establish a permanent site-to-site connection.

  When this WOULD be correct

  An administrator needs to provide secure, browser-based RDP/SSH access to Azure VMs in a VNet without exposing them to the public internet. The on-premises users must connect through Azure Bastion, not via a VPN tunnel.

• ✗

  A private endpoint for the Azure VNet.

  Why it's wrong here

  A private endpoint is a network interface with a private IP assigned from your Azure VNet that provides connectivity to a specific Azure PaaS service (such as storage or SQL) over Microsoft's backbone. It does not offer a generic IPsec/IKE tunnel or route for an entire branch office network, nor does it terminate on-premises firewall traffic. Without an existing VPN/ExpressRoute path, the office cannot even reach the endpoint, so it is not a site-to-site solution.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question