AZ-104 Implement and Manage Virtual Networking Practice Question
A company wants encrypted connectivity between its on-premises network and an Azure VNet. The organization has one edge VPN device at headquarters, and the Azure design must support a classic site-to-site tunnel rather than individual user VPN connections. Which three prerequisites are required? Select three.
⚠ Common exam trap
It's easy for candidates to confuse private endpoints (used for PaaS services) or ExpressRoute peering with the prerequisites for a classic site-to-site VPN, which strictly requires a GatewaySubnet, a public IP on the gateway, and a compatible on-premises VPN device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a virtual network gateway in a dedicated GatewaySubnet.
A virtual network gateway must be deployed in a dedicated subnet called GatewaySubnet to host the VPN gateway resources. This subnet is required for the gateway to function and must be named exactly 'GatewaySubnet' to be recognized by Azure when creating a site-to-site VPN connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a virtual network gateway in a dedicated GatewaySubnet.
Why this is correct
Azure VPN gateways must be deployed into the special GatewaySubnet within the VNet.
- ✓
Assign a public IP address to the Azure VPN gateway.
Why this is correct
The gateway needs a public-facing endpoint so the on-premises device can establish the tunnel.
- ✓
Configure the on-premises VPN device with a public IP and supported IKE/IPsec settings.
Why this is correct
The on-premises device must be reachable and must use compatible tunnel parameters.
- ✗
Create a private endpoint for the headquarters network.
Why it's wrong here
Private endpoints are for PaaS service access, not for hybrid VPN tunnel establishment.
When this WOULD be correct
A company requires secure, private connectivity from on-premises to an Azure Storage account without traversing the public internet. In that scenario, creating a private endpoint for the storage account in the VNet would be a correct prerequisite.
- ✗
Enable Microsoft peering on the virtual network gateway.
Why it's wrong here
Microsoft peering is associated with ExpressRoute concepts, not standard site-to-site VPN gateways.
When this WOULD be correct
In a scenario requiring private connectivity between Azure and an on-premises network via ExpressRoute, enabling Microsoft peering on the virtual network gateway allows access to Azure PaaS services over the ExpressRoute circuit.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Deploy a virtual network gateway in a dedicated GatewaySubnet.Correct answer▾
Why this is correct
Azure VPN gateways must be deployed into the special GatewaySubnet within the VNet.
✗Create a private endpoint for the headquarters network.Wrong answer — click to see why▾
Why this is wrong here
Private endpoints are used for secure access to Azure PaaS services (e.g., Storage, SQL) over a private IP within a VNet, not for establishing site-to-site VPN connectivity between on-premises and Azure.
★ When this WOULD be the correct answer
A company requires secure, private connectivity from on-premises to an Azure Storage account without traversing the public internet. In that scenario, creating a private endpoint for the storage account in the VNet would be a correct prerequisite.
Why candidates choose this
Candidates may confuse 'private endpoint' with 'private IP' or think it provides a secure tunnel, not realizing that site-to-site VPN requires a VPN gateway and public IP, not a private endpoint.
✗Enable Microsoft peering on the virtual network gateway.Wrong answer — click to see why▾
Why this is wrong here
Microsoft peering is used for ExpressRoute, not site-to-site VPN. A classic site-to-site tunnel requires a VPN gateway with a public IP and IKE/IPsec settings, not peering.
★ When this WOULD be the correct answer
In a scenario requiring private connectivity between Azure and an on-premises network via ExpressRoute, enabling Microsoft peering on the virtual network gateway allows access to Azure PaaS services over the ExpressRoute circuit.
Why candidates choose this
Candidates may confuse 'peering' with VPN connectivity or think that enabling peering is a generic step for any hybrid connection, not realizing it's specific to ExpressRoute.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.