An administrator needs two non-overlapping VNets in the same region to communicate directly over private IP addresses without deploying a gateway. What should be configured?

A site-to-site VPN gateway connection.

VPN gateways are used for encrypted network connections, but they are not required for direct VNet-to-VNet communication.

A service endpoint on both subnets.

Service endpoints extend subnet identity to a service, but they do not connect two VNets together.

A route table with default routes to each VNet.

Route tables can influence next hops, but they do not create the private connectivity needed between VNets.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: VNet peering between the two virtual networks. — VNet peering is the correct choice when two Azure virtual networks need direct private communication without a gateway. Peering uses Microsoft’s backbone network, so traffic stays on the Azure network fabric rather than crossing the public internet. Because the VNets are in the same region and do not overlap, peering is simple to deploy and gives the application teams low latency and straightforward connectivity. Why others are wrong: A site-to-site VPN gateway is for connecting Azure to on-premises or other routed networks, which is unnecessary overhead here. Service endpoints are for secure access to supported Azure services, not VNet-to-VNet communication. A route table changes packet routing, but it does not establish the actual private connection between the two virtual networks.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.