AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Azure portal validation output: Resource group: rg-network Virtual network: vnet-hub Subnet: GatewaySubnet exists Error: The virtual network gateway requires a public IP address to terminate VPN connections.
Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?
⚠ Common exam trap
Many exam-takers confuse the requirement for a public IP on the VPN gateway with the need for an NSG or route table on GatewaySubnet, but Azure explicitly blocks NSG association on GatewaySubnet and route tables are optional for site-to-site VPNs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A public IP address resource associated with the VPN gateway.
A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A public IP address resource associated with the VPN gateway.
Why this is correct
A VPN gateway needs a public IP resource so the on-premises VPN device can establish encrypted tunnels to Azure. The exhibit already has GatewaySubnet, so the missing piece is the public-facing IP on the gateway itself. Once that resource is created and attached during deployment, the gateway can be provisioned successfully.
- ✗
A network security group attached to GatewaySubnet.
Why it's wrong here
An NSG attached to GatewaySubnet is not a deployment requirement and is actually unsupported for VPN gateways because it can interfere with the control-plane traffic that Azure must send to the gateway instances. The exhibit already has GatewaySubnet, but the actual missing resource is a public IP address that gives the on-premises VPN device a routable endpoint to terminate the encrypted tunnel. Filtering traffic on this subnet would not create that public endpoint and could prevent the gateway from provisioning or operating correctly.
- ✗
A route table with a default route to the on-premises network.
Why it's wrong here
A route table with a default route to the on-premises network is a user-defined route (UDR) that would only be relevant after a site-to-site tunnel is established, and it would cause outbound Internet traffic to be force-tunneled through the VPN device. It does not supply the public IP address resource that the VPN gateway must be associated with during its deployment, because the gateway's external endpoint is essential for the initial IPsec handshake. Moreover, applying such a route to GatewaySubnet is unsupported and can break gateway connectivity.
When this WOULD be correct
This option would be correct in a scenario where a VPN gateway is already deployed but traffic is not flowing to on-premises, and the question asks why. The missing route table with a default route (0.0.0.0/0) pointing to the on-premises network via the VPN gateway would be the cause.
- ✗
A private endpoint for the on-premises VPN device.
Why it's wrong here
A private endpoint is designed to provide an Azure PaaS service with a private IP address inside your virtual network, enabling inbound access over a private connection rather than through the public Internet. An on-premises VPN device cannot use a private endpoint to terminate a site-to-site IPsec tunnel, because the VPN gateway itself must expose a public IP address as the tunnel endpoint. This option fails to address the actual missing resource and would not allow the VPN gateway to be deployed.
When this WOULD be correct
In a scenario where an Azure service (e.g., Storage Account) must be accessed privately from on-premises without traversing the internet, and a VPN or ExpressRoute is already in place, a private endpoint would be the correct resource to deploy.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A public IP address resource associated with the VPN gateway.Correct answer▾
Why this is correct
A VPN gateway needs a public IP resource so the on-premises VPN device can establish encrypted tunnels to Azure. The exhibit already has GatewaySubnet, so the missing piece is the public-facing IP on the gateway itself. Once that resource is created and attached during deployment, the gateway can be provisioned successfully.
✗A route table with a default route to the on-premises network.Wrong answer — click to see why▾
Why this is wrong here
A route table with a default route to the on-premises network is not required for VPN gateway deployment validation; the gateway automatically handles routing. The missing resource is a public IP address, which is mandatory for the gateway to establish connectivity.
★ When this WOULD be the correct answer
This option would be correct in a scenario where a VPN gateway is already deployed but traffic is not flowing to on-premises, and the question asks why. The missing route table with a default route (0.0.0.0/0) pointing to the on-premises network via the VPN gateway would be the cause.
Why candidates choose this
Candidates may think that a route table is needed to direct traffic to on-premises, but the VPN gateway itself creates necessary routes; the public IP is a prerequisite for the gateway resource.
✗A private endpoint for the on-premises VPN device.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint is used for secure access to Azure PaaS services over a private IP, not for VPN gateway connectivity. The VPN gateway requires a public IP for establishing the IPsec tunnel with the on-premises VPN device.
★ When this WOULD be the correct answer
In a scenario where an Azure service (e.g., Storage Account) must be accessed privately from on-premises without traversing the internet, and a VPN or ExpressRoute is already in place, a private endpoint would be the correct resource to deploy.
Why candidates choose this
Candidates may confuse 'private endpoint' with 'private IP' or think that a private connection to on-premises requires a private endpoint, not realizing that VPN gateways use public IPs for tunnel endpoints.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
VPN Gateway
A VPN Gateway is a network device or service that creates an encrypted tunnel between two or more networks over the internet, allowing secure communication.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?
medium- ✓ A.A public IP address resource that will be associated with the VPN gateway.
- B.A NAT gateway on the GatewaySubnet to translate tunnel traffic.
- C.A private endpoint in the GatewaySubnet for tunnel termination.
- D.A network security group that allows inbound TCP 443 to the subnet.
Why A: A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.