AZ-104 Implement and Manage Virtual Networking Practice Question
An on-premises datacenter must reach private IP addresses in Azure over an encrypted site-to-site tunnel. The Azure VMs must not have public IP addresses, and the connection should use the company's existing edge device. Which Azure component should be deployed?
⚠ Common exam trap
Watch out — candidates often confuse Azure Bastion (a secure access service) with a VPN gateway, because both involve 'secure connections' to Azure, but Bastion does not extend the on-premises network or support site-to-site tunneling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure VPN Gateway
Azure VPN Gateway is the correct component because it provides an encrypted site-to-site IPsec/IKE tunnel between an on-premises network and Azure virtual networks. It supports policy-based or route-based VPNs, works with existing edge devices, and allows Azure VMs to remain without public IP addresses by routing traffic through the gateway's private IP space.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed platform service that provides secure RDP and SSH access to virtual machines through the Azure portal over TLS, eliminating public IP exposure. It does not act as a network gateway or VPN endpoint; it never forwards arbitrary on-premises traffic to Azure private IPs. Bastion is for administrative, out-of-band access from a browser, not for site-to-site hybrid connectivity, so on-premises apps still cannot reach the datacenter IP space.
When this WOULD be correct
An exam question asking for a service that allows secure browser-based RDP/SSH connectivity to Azure VMs without public IPs, using a bastion host deployed in the same virtual network.
- ✓
Azure VPN Gateway
Why this is correct
VPN Gateway terminates the encrypted site-to-site tunnel and enables private connectivity from on-premises to Azure VNets. It works with the on-premises edge device and allows access to Azure private IPs without assigning public IPs to the target VMs.
- ✗
Azure Route Server
Why it's wrong here
Azure Route Server is a control-plane service that enables BGP peering with network virtual appliances in Azure, allowing dynamic route exchange between the NVAs and the VNet's software-defined network. It does not terminate IPsec tunnels, encrypt traffic, or contain a data-plane path; unlike a VPN Gateway, it does not create a site-to-site connection to on-premises. Even with BGP routes peered, on-premises traffic still needs a gateway for the tunnel's data plane.
When this WOULD be correct
An organization has multiple NVAs in Azure that need to exchange routes with an on-premises network via BGP, and they want to simplify route management without configuring BGP on each NVA individually.
- ✗
A network security group with inbound allow rules
Why it's wrong here
An NSG is a stateful, distributed firewall that filters traffic at an Azure subnet or network interface level; it can only permit or block packets after they arrive. It has no IPsec/IKE endpoint, no public-facing VPN interface, and no routing capability to connect an on-premises data center to Azure private IPs. Even with an inbound 'Allow any' rule, the on-premises network has no encrypted tunnel or route into the VNet, so traffic never reaches Azure.
When this WOULD be correct
An NSG with inbound allow rules would be correct in a scenario where you need to control which source IPs can access Azure VMs over an existing encrypted connection (e.g., via ExpressRoute or VPN already in place), and the question focuses on security filtering rather than establishing connectivity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure VPN GatewayCorrect answer▾
Why this is correct
VPN Gateway terminates the encrypted site-to-site tunnel and enables private connectivity from on-premises to Azure VNets. It works with the on-premises edge device and allows access to Azure private IPs without assigning public IPs to the target VMs.
✗Azure BastionWrong answer — click to see why▾
Why this is wrong here
Azure Bastion provides secure RDP/SSH access to VMs without public IPs, but it does not create an encrypted site-to-site tunnel from on-premises to Azure private IPs.
★ When this WOULD be the correct answer
An exam question asking for a service that allows secure browser-based RDP/SSH connectivity to Azure VMs without public IPs, using a bastion host deployed in the same virtual network.
Why candidates choose this
Candidates may confuse 'secure access without public IPs' with the site-to-site VPN requirement, overlooking that Bastion is for management access, not network connectivity.
✗Azure Route ServerWrong answer — click to see why▾
Why this is wrong here
Azure Route Server is used for dynamic routing between network virtual appliances (NVAs) and Azure virtual networks, not for creating encrypted site-to-site tunnels to on-premises datacenters.
★ When this WOULD be the correct answer
An organization has multiple NVAs in Azure that need to exchange routes with an on-premises network via BGP, and they want to simplify route management without configuring BGP on each NVA individually.
Why candidates choose this
Candidates may confuse Route Server's role in routing with VPN Gateway's role in tunneling, assuming it can handle site-to-site connectivity because it deals with network routes.
✗A network security group with inbound allow rulesWrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) filters traffic but does not provide encrypted site-to-site connectivity or routing between on-premises and Azure private IPs.
★ When this WOULD be the correct answer
An NSG with inbound allow rules would be correct in a scenario where you need to control which source IPs can access Azure VMs over an existing encrypted connection (e.g., via ExpressRoute or VPN already in place), and the question focuses on security filtering rather than establishing connectivity.
Why candidates choose this
Candidates may think NSGs can secure the tunnel or allow traffic, confusing network security with VPN connectivity, or they overlook that NSGs alone cannot create a site-to-site VPN.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
VPN Gateway
A VPN Gateway is a network device or service that creates an encrypted tunnel between two or more networks over the internet, allowing secure communication.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.