How to Connect a Branch Office to Azure with a Site-to-Site VPN Gateway
A branch office with a static public IP needs encrypted connectivity to an Azure virtual network so users can access private Azure VMs and internal services. The connection should support a site-to-site design and not rely on public IPs for the Azure resources themselves. Which service should the administrator deploy?
Quick Answer
The answer is a VPN gateway with a site-to-site connection. This is correct because it establishes an encrypted IPsec/IKE tunnel between the branch office’s static public IP and the Azure VPN gateway, allowing users to access private Azure VMs and internal services without exposing those resources to the public internet. On the AZ-104 exam, this scenario tests your understanding of hybrid networking—specifically how to securely extend an on-premises network into Azure while keeping VNet resources private. A common trap is confusing a point-to-site VPN (which supports individual clients) with site-to-site (which connects entire networks). Remember: static public IP on-premises plus encrypted tunnel equals site-to-site VPN gateway. A quick memory tip is “S2S for sites, P2S for people”—if the branch office has a fixed public IP and needs full network-to-network connectivity, you always deploy a site-to-site VPN gateway.
⚠ Common exam trap
Watch out — candidates often confuse site-to-site VPN with VNet peering or service endpoints, mistakenly thinking those can provide encrypted on-premises connectivity, but they lack the necessary IPsec tunnel and on-premises-to-Azure routing capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPN gateway with a site-to-site connection
A VPN gateway with a site-to-site connection (option C) is the correct choice because it provides encrypted connectivity over the public internet between an on-premises branch office with a static public IP and an Azure virtual network. This design uses IPsec/IKE (RFC 4301) to secure traffic, and Azure resources remain private within the VNet, not requiring public IPs. The site-to-site connection establishes a tunnel from the on-premises VPN device to the Azure VPN gateway, enabling users to access private VMs and services securely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VNet peering
Why it's wrong here
Peering connects Azure VNets to each other, but it does not connect a branch office network directly to Azure.
When this WOULD be correct
An administrator needs to connect two Azure virtual networks in different regions with low-latency, private IP communication. VNet peering would be correct when both networks are in Azure and no on-premises connectivity is required.
- ✗
Service endpoint
Why it's wrong here
Service endpoints are for Azure service access from a VNet, not for encrypted branch-to-Azure network connectivity.
When this WOULD be correct
A question that asks: 'Which feature allows an Azure virtual network to access an Azure Storage account using private IP addresses from the VNet, without traversing the public internet?' In that scenario, service endpoints would be the correct answer.
- ✓
VPN gateway with a site-to-site connection
Why this is correct
A VPN gateway is the standard Azure service for encrypted site-to-site connectivity between an on-premises network and an Azure VNet. It allows branch users to reach private IPs in Azure without exposing the VMs to the internet. Because the branch has a static public IP, it can terminate a reliable site-to-site tunnel to the Azure VPN gateway.
- ✗
Azure Front Door
Why it's wrong here
Front Door is for global HTTP(S) traffic acceleration and application delivery, not private network connectivity between sites.
When this WOULD be correct
An administrator needs to provide secure, accelerated global access to a public-facing web application hosted in Azure, with features like SSL offloading, WAF, and URL-based routing. The question would specify that the application is HTTP/HTTPS-based and requires global load balancing across multiple regions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓VPN gateway with a site-to-site connectionCorrect answer▾
Why this is correct
A VPN gateway is the standard Azure service for encrypted site-to-site connectivity between an on-premises network and an Azure VNet. It allows branch users to reach private IPs in Azure without exposing the VMs to the internet. Because the branch has a static public IP, it can terminate a reliable site-to-site tunnel to the Azure VPN gateway.
✗Azure VNet peeringWrong answer — click to see why▾
Why this is wrong here
Azure VNet peering connects two Azure virtual networks, not an on-premises branch office to Azure. It does not support site-to-site VPN connectivity over the internet or encrypted tunnels from on-premises.
★ When this WOULD be the correct answer
An administrator needs to connect two Azure virtual networks in different regions with low-latency, private IP communication. VNet peering would be correct when both networks are in Azure and no on-premises connectivity is required.
Why candidates choose this
Candidates may confuse VNet peering with VPN connectivity because both involve connecting networks, but they overlook that peering is Azure-to-Azure only and does not support on-premises branch offices.
✗Service endpointWrong answer — click to see why▾
Why this is wrong here
Service endpoints provide private connectivity from a virtual network to Azure PaaS services (e.g., Storage, SQL) over the Microsoft backbone, but they do not support encrypted site-to-site VPN connectivity from an on-premises branch office to Azure VMs.
★ When this WOULD be the correct answer
A question that asks: 'Which feature allows an Azure virtual network to access an Azure Storage account using private IP addresses from the VNet, without traversing the public internet?' In that scenario, service endpoints would be the correct answer.
Why candidates choose this
Candidates may confuse service endpoints with VPN connections because both involve 'private' connectivity to Azure, but service endpoints are limited to Azure PaaS services and do not provide site-to-site VPN capabilities for on-premises networks.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door is a global load balancer and application delivery controller that operates at Layer 7 (HTTP/HTTPS). It does not provide site-to-site IPsec VPN connectivity for encrypted access to private Azure VMs and internal services; it is designed for web applications with public endpoints.
★ When this WOULD be the correct answer
An administrator needs to provide secure, accelerated global access to a public-facing web application hosted in Azure, with features like SSL offloading, WAF, and URL-based routing. The question would specify that the application is HTTP/HTTPS-based and requires global load balancing across multiple regions.
Why candidates choose this
Candidates may confuse Azure Front Door's SSL/TLS termination and 'encrypted connectivity' capabilities with the site-to-site VPN requirement, or they might think Front Door can secure access to private resources via Private Link, but the question explicitly requires site-to-site design and no public IPs for Azure resources.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A branch office has a single edge device with a static public IP and must connect securely to Azure so users can reach private VMs in a virtual network. The company wants traffic encrypted across the internet and does not need point-to-site access from individual laptops. Which solution should the administrator deploy?
medium- A.A point-to-site VPN configuration for each user laptop.
- ✓ B.A site-to-site VPN gateway connection.
- C.A private endpoint to each virtual machine in Azure.
- D.VNet peering between the branch and Azure.
Why B: A site-to-site VPN gateway connection (Option B) is correct because it creates an encrypted tunnel over the internet between the branch office's edge device with a static public IP and an Azure VPN gateway, allowing users to securely access private VMs in the virtual network. This solution meets the requirement for encrypted traffic across the internet without needing point-to-site access for individual laptops, as the entire branch network is connected via the VPN tunnel.
Variation 2. A branch office uses an on-premises firewall that supports IPsec/IKE and has a stable public IP. The office needs always-on private connectivity to an Azure VNet over the internet. Which Azure component should the administrator deploy?
medium- ✓ A.A site-to-site connection using Azure VPN Gateway.
- B.VNet peering between the branch office and the Azure VNet.
- C.Azure Bastion in the target VNet.
- D.A private endpoint for the Azure VNet.
Why A: A site-to-site VPN connection using Azure VPN Gateway is the correct choice because it provides always-on, encrypted connectivity over the internet between an on-premises network with a stable public IP and an Azure VNet. Azure VPN Gateway supports IPsec/IKE protocols, which are compatible with the branch office's firewall, enabling a secure tunnel that meets the requirement for private connectivity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.