AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Gateway deployment validation output: GatewaySubnet: Present Gateway type: VPN VPN type: Route-based Validation error: A public IP address resource must be specified for the gateway. Current gateway configuration: No public IP attached.
Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?
⚠ Common exam trap
Test-takers frequently confuse the prerequisite for a VPN gateway with that of an Azure Firewall or NAT gateway, mistakenly thinking a NAT gateway or NSG is required, when in fact only a public IP is mandatory for the VPN gateway to function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A public IP address resource that will be associated with the VPN gateway.
A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A public IP address resource that will be associated with the VPN gateway.
Why this is correct
Azure VPN gateways need a public-facing IP resource so the gateway can accept encrypted tunnels from the on-premises device. The exhibit shows the gateway subnet is already present, but no public IP was attached. Creating and associating the public IP resource satisfies the deployment prerequisite.
- ✗
A NAT gateway on the GatewaySubnet to translate tunnel traffic.
Why it's wrong here
A NAT gateway on GatewaySubnet is an outbound internet translation mechanism for VMs and workloads; it does not provide a globally routable ingress endpoint for VPN tunnels. A site-to-site VPN gateway receives inbound IPsec connections on its associated public IP, and a NAT gateway cannot supply that public IP resource or act as the tunnel endpoint. Even if a NAT gateway were deployed, the validation failure for a missing gateway public IP address would remain unresolved.
When this WOULD be correct
In a scenario where on-premises network uses overlapping IP addresses with Azure VNet, a NAT gateway on the GatewaySubnet could be used to translate traffic to avoid conflicts, but this is not a prerequisite for basic VPN gateway creation.
- ✗
A private endpoint in the GatewaySubnet for tunnel termination.
Why it's wrong here
Private endpoints are designed to provide private, inbound connectivity to PaaS services using VNet IP addresses; they are not VPN termination points. Site-to-site tunnels terminate on the VPN gateway, which must have a public IP address to be reachable from the on-premises device. A private endpoint has no public IP and cannot accept IPsec or IKE traffic, and placing one on GatewaySubnet would not address the missing gateway public IP resource that is causing the validation failure.
When this WOULD be correct
If the question were about securely accessing an Azure SQL Database from on-premises without exposing it to the internet, a private endpoint in a virtual network (not necessarily GatewaySubnet) would be the correct prerequisite to create.
- ✗
A network security group that allows inbound TCP 443 to the subnet.
Why it's wrong here
An NSG allowing inbound TCP 443 is irrelevant to site-to-site VPN tunnel establishment. IPsec IKE and ESP traffic uses UDP 500 (IKE), UDP 4500 (IPsec NAT traversal), and ESP protocol 50, not TCP 443. Moreover, Azure VPN gateways require a dedicated public IP resource to be attached to the GatewaySubnet; the validation error is about that missing public IP, not about a missing inbound permission. NSGs on GatewaySubnet also have specific required rules, and adding unrelated rules does not satisfy gateway creation prerequisites.
When this WOULD be correct
This option would be correct if the question asked: 'After deploying a VPN gateway, users cannot connect. What is missing?' or 'What must be configured to allow management traffic from Azure to the VPN gateway?' — where inbound TCP 443 is required for Azure gateway management.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A public IP address resource that will be associated with the VPN gateway.Correct answer▾
Why this is correct
Azure VPN gateways need a public-facing IP resource so the gateway can accept encrypted tunnels from the on-premises device. The exhibit shows the gateway subnet is already present, but no public IP was attached. Creating and associating the public IP resource satisfies the deployment prerequisite.
✗A NAT gateway on the GatewaySubnet to translate tunnel traffic.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway is not required for a site-to-site VPN gateway deployment. VPN gateways use public IP addresses for tunnel endpoints, and traffic translation is handled by the VPN gateway itself, not a separate NAT gateway.
★ When this WOULD be the correct answer
In a scenario where on-premises network uses overlapping IP addresses with Azure VNet, a NAT gateway on the GatewaySubnet could be used to translate traffic to avoid conflicts, but this is not a prerequisite for basic VPN gateway creation.
Why candidates choose this
Candidates may confuse NAT gateway with the need for public IP translation or think that outbound traffic from the GatewaySubnet requires NAT, but VPN gateways handle their own public IP addressing.
✗A private endpoint in the GatewaySubnet for tunnel termination.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint is used for private connectivity to Azure PaaS services over a private IP, not for terminating site-to-site VPN tunnels. VPN gateways require a public IP and do not use private endpoints in the GatewaySubnet.
★ When this WOULD be the correct answer
If the question were about securely accessing an Azure SQL Database from on-premises without exposing it to the internet, a private endpoint in a virtual network (not necessarily GatewaySubnet) would be the correct prerequisite to create.
Why candidates choose this
Candidates may confuse private endpoints with VPN endpoints, thinking that a private IP termination is needed for security, but VPN gateways inherently use public IPs for tunnel establishment.
✗A network security group that allows inbound TCP 443 to the subnet.Wrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) on the GatewaySubnet is not a prerequisite for VPN gateway creation; NSGs are optional and can be applied after deployment. The failure is due to missing a public IP resource, not NSG rules.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'After deploying a VPN gateway, users cannot connect. What is missing?' or 'What must be configured to allow management traffic from Azure to the VPN gateway?' — where inbound TCP 443 is required for Azure gateway management.
Why candidates choose this
Candidates may think NSGs are mandatory for security or that inbound 443 is needed for VPN tunnel establishment, confusing management traffic with tunnel traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?
easy- ✓ A.A public IP address resource associated with the VPN gateway.
- B.A network security group attached to GatewaySubnet.
- C.A route table with a default route to the on-premises network.
- D.A private endpoint for the on-premises VPN device.
Why A: A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.