AZ-104 Implement and Manage Virtual Networking Practice Question
An administrator is deploying a route-based site-to-site VPN gateway. The GatewaySubnet already exists, but validation fails because the public IP configuration is incompatible with the chosen gateway. Which public IP setup is required for the gateway?
⚠ Common exam trap
It's easy for candidates to assume any static public IP will work, overlooking the SKU requirement—Azure specifically mandates Standard SKU for route-based VPN gateways, and Basic SKU is only valid for policy-based gateways or other services like basic load balancers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Standard SKU public IP with static allocation.
For a route-based site-to-site VPN gateway in Azure, the gateway must use a Standard SKU public IP address with static allocation. This is because route-based VPN gateways require the public IP to be statically assigned and the Standard SKU provides the necessary features like availability zones and zone resiliency, which are not supported by the Basic SKU. The Basic SKU public IP is incompatible with route-based VPN gateways, and a private IP from the GatewaySubnet cannot serve as the public endpoint for the VPN connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Basic SKU public IP with dynamic allocation.
Why it's wrong here
Choosing a Basic SKU public IP with dynamic allocation introduces two deployment blockers: the SKU is not Standard as required by Azure VPN gateways, and dynamic allocation is not permitted for a VPN gateway's public IP. VPN gateways need a fixed, statically allocated IP address so that on-premises VPN devices can consistently reach the gateway endpoint without relying on a potentially changing address. When the gateway restarts or is redeployed, a dynamic IP could change, breaking the tunnel configuration.
When this WOULD be correct
This option would be correct for a policy-based VPN gateway (not route-based) or for a gateway that only needs basic connectivity without BGP or active-active support, such as a simple point-to-site VPN with Basic SKU.
- ✗
A Basic SKU public IP with static allocation.
Why it's wrong here
A Basic SKU public IP with a static allocation is still invalid because Azure VPN gateways mandate a Standard SKU public IP, regardless of allocation method. The gateway resource is validated against SKU requirements during provisioning, and a Basic SKU does not support the availability-zone and Internet-facing network capabilities expected by the virtual network gateway. Even if the address were static, the Basic SKU alone causes deployment to fail.
When this WOULD be correct
This option would be correct for a policy-based VPN gateway, which supports Basic SKU public IPs with static allocation. For example, if the question specified 'policy-based site-to-site VPN gateway', then a Basic SKU static public IP would be required.
- ✓
A Standard SKU public IP with static allocation.
Why this is correct
Azure VPN gateways require a Standard public IP configuration, and the address must be statically allocated. This is part of the gateway's external-facing connectivity requirement and is validated during deployment. If a Basic or dynamically assigned public IP is selected, gateway creation can fail even when GatewaySubnet already exists and is sized correctly.
- ✗
A private IP address assigned directly from GatewaySubnet.
Why it's wrong here
Assigning a private IP from GatewaySubnet to the VPN gateway is incorrect because site-to-site VPN connectivity is Internet-facing and requires a public endpoint. The private IP would only be used for the gateway's internal interfaces; without a public IP resource, there is no externally reachable address for the on-premises VPN device to connect to. Azure also requires a public IP resource to be attached to the gateway's IP configuration, so a purely private address cannot satisfy the deployment requirements.
When this WOULD be correct
This would be correct if the question asked about configuring an internal-only VPN gateway (e.g., for ExpressRoute or VNet-to-VNet) that does not require public IP, or if the scenario specified using a private endpoint for VPN.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Standard SKU public IP with static allocation.Correct answer▾
Why this is correct
Azure VPN gateways require a Standard public IP configuration, and the address must be statically allocated. This is part of the gateway's external-facing connectivity requirement and is validated during deployment. If a Basic or dynamically assigned public IP is selected, gateway creation can fail even when GatewaySubnet already exists and is sized correctly.
✗A Basic SKU public IP with dynamic allocation.Wrong answer — click to see why▾
Why this is wrong here
Route-based VPN gateways require a Standard SKU public IP with static allocation. Basic SKU public IPs do not support the necessary features like BGP and active-active mode for route-based VPNs.
★ When this WOULD be the correct answer
This option would be correct for a policy-based VPN gateway (not route-based) or for a gateway that only needs basic connectivity without BGP or active-active support, such as a simple point-to-site VPN with Basic SKU.
Why candidates choose this
Candidates may assume Basic SKU is sufficient because it is cheaper and commonly used for other Azure resources, or they may confuse the requirements for policy-based vs. route-based VPN gateways.
✗A Basic SKU public IP with static allocation.Wrong answer — click to see why▾
Why this is wrong here
For a route-based VPN gateway, Azure requires a Standard SKU public IP with static allocation. Basic SKU public IPs are not supported for route-based VPN gateways.
★ When this WOULD be the correct answer
This option would be correct for a policy-based VPN gateway, which supports Basic SKU public IPs with static allocation. For example, if the question specified 'policy-based site-to-site VPN gateway', then a Basic SKU static public IP would be required.
Why candidates choose this
Candidates may confuse route-based and policy-based VPN gateways, or assume that Basic SKU is sufficient since it works for other resources like VMs, leading them to overlook the specific SKU requirement for route-based gateways.
✗A private IP address assigned directly from GatewaySubnet.Wrong answer — click to see why▾
Why this is wrong here
A route-based site-to-site VPN gateway requires a public IP address for internet-facing communication; a private IP from GatewaySubnet cannot be used for external connectivity.
★ When this WOULD be the correct answer
This would be correct if the question asked about configuring an internal-only VPN gateway (e.g., for ExpressRoute or VNet-to-VNet) that does not require public IP, or if the scenario specified using a private endpoint for VPN.
Why candidates choose this
Candidates may confuse GatewaySubnet with the source of the gateway's IP address, thinking a private IP is sufficient for internal routing, or overlook the public IP requirement for site-to-site VPN.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
VPN Gateway
A VPN Gateway is a network device or service that creates an encrypted tunnel between two or more networks over the internet, allowing secure communication.
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.