AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A public IP address resource.

  Why this is correct

  A VPN gateway must have a public IP address resource to serve as the external endpoint for the site-to-site tunnel. This public IP is assigned to the gateway object (not a VM NIC) and is the address your on-premises VPN device connects to over the internet. Without it, the gateway has no routable public-facing address, so the IPsec/IKE handshake cannot be initiated.

• ✗

  A private endpoint.

  Why it's wrong here

  A private endpoint is designed to provide private, internal IP access to Azure PaaS services (e.g., Storage, SQL Database) within a virtual network. It does not provide a public endpoint and cannot accept inbound site-to-site VPN traffic from the internet. A VPN gateway is a different service and relies on a public IP, not a private endpoint.

  When this WOULD be correct

  A private endpoint would be correct in a scenario where you need to connect to an Azure SQL Database or Storage Account privately from a virtual network, without exposing it to the public internet. For example: 'An administrator needs to ensure that traffic to an Azure SQL Database from a virtual network never traverses the public internet. Which resource should be deployed?'

• ✗

  A service endpoint.

  Why it's wrong here

  Service endpoints extend a subnet's connectivity to Azure services over the Microsoft backbone without going over the internet, but they do not create a public IP address or provide a VPN termination point. A service endpoint is about addressing the service's private endpoint (e.g., default service endpoint for Storage), not about establishing an encrypted site-to-site tunnel. Thus, it cannot replace the public IP resource required by the gateway.

  When this WOULD be correct

  This option would be correct in a question about securing access to an Azure service (e.g., Azure Storage) from a virtual network, where a service endpoint is used to restrict traffic to that service from the VNet only.

• ✗

  A network security group.

  Why it's wrong here

  A network security group (NSG) is a traffic-filtering layer for subnets and network interfaces; it has no role in creating a public-facing endpoint or terminating VPN tunnels. You cannot use an NSG to supply the public IP required by the gateway, and NSGs are subject to specific restrictions on the GatewaySubnet. Its function is access control, not connectivity termination.

  When this WOULD be correct

  An NSG would be correct in a question asking which resource can be associated with a subnet to restrict inbound/outbound traffic to/from Azure resources, such as controlling access to a virtual machine.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question