AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Branch office details: - One edge firewall/router with public IP 203.0.113.50 - Users must reach private Azure VMs and internal services - Traffic must be encrypted over the internet - No per-user tunnel setup is desired
Based on the exhibit, which Azure connectivity option should the administrator use for the branch office?
⚠ Common exam trap
Test-takers frequently confuse VNet peering (Option B) as a hybrid connectivity solution, but it only works between Azure VNets and cannot connect on-premises networks, making site-to-site VPN the correct choice for branch office connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A site-to-site VPN connection to an Azure VPN gateway.
A site-to-site VPN connection to an Azure VPN gateway (Option D) is the correct choice because it provides a persistent, encrypted tunnel between the branch office's on-premises network and Azure, enabling seamless connectivity for all users and devices at the branch without requiring per-user configuration. This aligns with the typical scenario where a branch office needs constant, secure access to Azure resources, and the VPN gateway supports IPsec/IKE protocols for site-to-site connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Point-to-site VPN for each user laptop.
Why it's wrong here
A point-to-site VPN is a user-based remote access solution that requires every laptop to run a VPN client and create an individual SSTP, IKEv2, or OpenVPN tunnel to the Azure VPN gateway. The exhibit clearly shows a shared branch office network edge device, so this approach would require managing hundreds of per-device configurations and would fail to route traffic for the entire office. It is the wrong choice for site-to-site connectivity.
When this WOULD be correct
This would be correct in a scenario where the branch office has remote or mobile users who need individual VPN connections to access Azure resources, and there is no on-premises network gateway or static IP address for a site-to-site VPN.
- ✗
VNet peering between the branch office and Azure.
Why it's wrong here
VNet peering connects two Azure virtual networks—either in the same region or across regions—through the Microsoft backbone, and it does not support on-premises networks. The branch office is an external site, not a virtual network, so peering cannot be established between it and Azure. VNet peering also carries no IPsec encryption or internet-based tunneling, making it unsuitable for hybrid branch connectivity.
When this WOULD be correct
A question where two Azure virtual networks in different regions or subscriptions need to be connected privately and directly, such as for resource sharing or network traffic routing between VNets.
- ✗
A service endpoint on the Azure subnet.
Why it's wrong here
A service endpoint on the Azure subnet is used to restrict traffic to Azure PaaS services such as Azure Storage or SQL Database by routing VNet-originated traffic over the Microsoft backbone. It does not provide any encrypted tunnel or gateway for an on-premises branch office, nor does it extend a VNet to external sites. Service endpoints secure service access but cannot replace a site-to-site VPN for branch-to-Azure connectivity.
When this WOULD be correct
A service endpoint would be correct in a scenario where the question asks how to restrict access to an Azure PaaS service (e.g., Azure Storage) to traffic originating only from a specific Azure subnet, ensuring private IP addresses are used and traffic stays on the Microsoft backbone.
- ✓
A site-to-site VPN connection to an Azure VPN gateway.
Why this is correct
A site-to-site VPN is designed for a branch office network with a single edge device. It creates encrypted connectivity over the internet to Azure so users can reach private resources without setting up individual tunnels on every laptop.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A site-to-site VPN connection to an Azure VPN gateway.Correct answer▾
Why this is correct
A site-to-site VPN is designed for a branch office network with a single edge device. It creates encrypted connectivity over the internet to Azure so users can reach private resources without setting up individual tunnels on every laptop.
✗Point-to-site VPN for each user laptop.Wrong answer — click to see why▾
Why this is wrong here
Point-to-site VPN connects individual user laptops to Azure, not the entire branch office network. The question requires a site-to-site connection for the whole office, not per-user access.
★ When this WOULD be the correct answer
This would be correct in a scenario where the branch office has remote or mobile users who need individual VPN connections to access Azure resources, and there is no on-premises network gateway or static IP address for a site-to-site VPN.
Why candidates choose this
Candidates may confuse point-to-site with site-to-site VPN, or think that providing per-user connectivity is sufficient for the branch office, overlooking the requirement for network-level connectivity.
✗VNet peering between the branch office and Azure.Wrong answer — click to see why▾
Why this is wrong here
VNet peering connects virtual networks within Azure, not on-premises branch offices. It cannot extend an on-premises network to Azure; it only links Azure VNets together.
★ When this WOULD be the correct answer
A question where two Azure virtual networks in different regions or subscriptions need to be connected privately and directly, such as for resource sharing or network traffic routing between VNets.
Why candidates choose this
Candidates may confuse VNet peering with hybrid connectivity, thinking it can connect on-premises networks to Azure, but it only works between Azure VNets.
✗A service endpoint on the Azure subnet.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint secures Azure service access from a virtual network but does not provide connectivity from an on-premises branch office to Azure; it is not a remote access or site-to-site connectivity solution.
★ When this WOULD be the correct answer
A service endpoint would be correct in a scenario where the question asks how to restrict access to an Azure PaaS service (e.g., Azure Storage) to traffic originating only from a specific Azure subnet, ensuring private IP addresses are used and traffic stays on the Microsoft backbone.
Why candidates choose this
Candidates may confuse service endpoints with VPN or connectivity options, thinking that enabling a service endpoint on a subnet somehow extends network connectivity to on-premises locations, when in fact it only controls access to Azure services from within Azure.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
VPN Gateway
A VPN Gateway is a network device or service that creates an encrypted tunnel between two or more networks over the internet, allowing secure communication.
Key term
Azure VPN Gateway
A cloud-based virtual private network gateway in Microsoft Azure that securely connects on-premises networks to Azure virtual networks over encrypted tunnels.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.