AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Site-to-site VPN, because it is the standard option for any remote access.

  Why it's wrong here

  Site-to-site VPN requires a persistent, IPsec-based tunnel between an on-premises network and an Azure VPN gateway, which means a dedicated VPN appliance or router must be configured at the remote site. This is not feasible for a contractor working from home, as it demands static public IP addresses, specialized hardware, and a permanent network-to-network link. It is designed for full site connectivity, not for granting temporary access to a single individual endpoint.

  When this WOULD be correct

  You need to connect an entire branch office network to an Azure virtual network securely over the internet, and the branch has a compatible VPN device. Site-to-site VPN would be the correct choice.

• ✓

  Point-to-site VPN, because it connects an individual client to the virtual network.

  Why this is correct

  Point-to-site VPN is the correct solution because it establishes a secure, encrypted tunnel from an individual client computer to an Azure virtual network over the public internet. It uses protocols such as IKEv2, SSTP, or OpenVPN and authenticates the user or device before granting access to private resources inside the VNet. This makes it ideal for a single remote user needing temporary access without exposing workloads publicly.

• ✗

  VNet peering, because it can securely connect any remote device to Azure.

  Why it's wrong here

  VNet peering is a networking feature that connects two Azure virtual networks, allowing traffic to flow between them using the Microsoft backbone. It does not provide any mechanism for a standalone device like a laptop to connect from outside Azure, because peering operates at the virtual network layer, not at the client or remote-access layer. A home PC could never become a peer, so this option cannot meet the contractor's need.

  When this WOULD be correct

  A question where two Azure virtual networks in different regions need to communicate privately and securely, without using the public internet or a VPN gateway. For example: 'You have two VNets in different Azure regions that must communicate with low latency. Which connectivity option should you use?'

• ✗

  ExpressRoute, because it is the simplest option for temporary contractor access.

  Why it's wrong here

  ExpressRoute provides a private, dedicated, and redundant network connection between an organization's premises and Azure using a telecommunications provider, bypassing the public internet entirely. It requires significant lead time, contractual commitments, and high costs, making it completely inappropriate for short-term, temporary access for one contractor. The complexity and expense of provisioning an ExpressRoute circuit far exceed the needs of an individual remote worker.

  When this WOULD be correct

  A company needs a high-speed, low-latency, private connection between its on-premises data center and Azure for consistent, large-scale workloads, and is willing to commit to a long-term contract with a connectivity provider.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question