AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  An Azure Virtual Network peering connection to the branch office network.

  Why it's wrong here

  Azure Virtual Network peering connects two or more Azure VNets, regardless of region, over Microsoft's backbone network, providing low-latency private connectivity between virtual networks in the cloud. It does not support connections to on-premises branch sites because an on-premises network cannot be 'peered' into a VNet; peering is strictly an Azure-to-Azure capability. To connect the branch office, a VPN gateway or ExpressRoute circuit is required, and since the branch has a fixed public IP and needs encryption, a site-to-site VPN is the appropriate choice.

  When this WOULD be correct

  When connecting two Azure VNets in the same or different regions for private, high-bandwidth connectivity without traversing the internet, VNet peering is the correct choice.

• ✓

  A VPN gateway with a site-to-site connection.

  Why this is correct

  A site-to-site VPN gateway creates an encrypted tunnel from the branch office to Azure over the public internet. Because the branch has a static public IP and the requirement calls for route-based connectivity, this is the correct Azure networking service. Once deployed, the gateway can provide private access to VMs and internal services in the virtual network without exposing them directly to the internet.

• ✗

  A service endpoint on the target subnet.

  Why it's wrong here

  A service endpoint on a target subnet is a feature that extends your virtual network's identity and private address space to specific Azure PaaS services, such as Azure Storage or SQL, by adding the subnet's route to the service's public IP range. It does not create an encrypted tunnel between your on-premises branch office and the VNet; it only secures PaaS traffic from the subnet to the service using the Azure backbone. Service endpoints are also not route-based VPN devices, so they cannot satisfy the requirement for encrypted access to the entire virtual network from a branch office with a static public IP.

  When this WOULD be correct

  A question requiring secure, private access from a VNet to Azure PaaS services (e.g., Azure Storage or SQL Database) without traversing the public internet, using the Microsoft backbone network, and where the client is within the same Azure region or a peered VNet.

• ✗

  An Azure private endpoint for the virtual machines.

  Why it's wrong here

  An Azure private endpoint is a network interface with a private IP address from your virtual network, used exclusively for connecting to supported Azure PaaS services such as Azure SQL Database, Storage, or Key Vault. It cannot be applied to a virtual machine or an entire virtual network, because IaaS VMs already have their own private IPs and the endpoint does not provide a gateway for encrypted site-to-site traffic. Since the branch office requirement is to establish an encrypted tunnel to the whole VNet, a private endpoint is technically inapplicable and would not create the needed IPsec connection.

  When this WOULD be correct

  An administrator needs to securely access an Azure PaaS service (e.g., Azure SQL Database) from a VNet without exposing it to the public internet, using a private IP address within the VNet.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question