AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A load balancer frontend IP configuration in front of the gateway subnet.

  Why it's wrong here

  A load balancer frontend IP configuration distributes inbound traffic across a backend pool of virtual machines or other resources; an Azure VPN gateway is a single managed gateway instance that terminates IPsec tunnels directly. You cannot place a load balancer in front of GatewaySubnet because the VPN gateway must have its own public IP address resource assigned directly to it, and there is no backend pool of gateway instances to load-balance traffic across. Using a load balancer would create an additional, unsupported network hop instead of satisfying the gateway's required public endpoint.

  When this WOULD be correct

  This option would be correct in a scenario where you need to distribute inbound traffic across multiple VPN gateways or provide high availability for VPN connections, and the question asks for a way to expose a single public IP for multiple gateways using a load balancer.

• ✓

  A public IP address resource associated with the VPN gateway.

  Why this is correct

  Azure VPN gateways require a public IP address resource so the on-premises VPN device can establish the tunnel to a known public endpoint. The gateway is deployed in GatewaySubnet, and the public IP is attached as part of the gateway configuration. Without that resource, the VPN gateway cannot be created successfully.

• ✗

  A NAT gateway attached to GatewaySubnet.

  Why it's wrong here

  A NAT gateway attached to GatewaySubnet performs source network address translation for outbound traffic, not inbound tunnel termination. It does not provide a routable public endpoint that an on-premises VPN device can use to establish an IPsec/IKE session. In fact, Azure does not support associating a NAT gateway with a GatewaySubnet because the VPN gateway must bind directly to a public IP address it owns, not to a NATed translation.

  When this WOULD be correct

  In a scenario where you need to provide outbound internet access for resources in a subnet (e.g., to access external APIs) while preventing inbound connections, a NAT gateway attached to the subnet would be the correct answer.

• ✗

  A private endpoint for the virtual network gateway resource.

  Why it's wrong here

  A private endpoint is designed to give an Azure PaaS resource a private IP address inside a virtual network so clients can connect over the Microsoft backbone without going over the public internet. The Microsoft.Network/virtualNetworkGateways resource type does not support private endpoint configuration, and even if it did, a private endpoint would not expose a public IP address for the on-premises VPN device to target. Site-to-site VPN tunnels require the gateway to terminate the tunnel at a publicly routable address, which a private endpoint cannot provide.

  When this WOULD be correct

  In a scenario where an organization requires a private, secure connection to an Azure VPN gateway without exposing it to the public internet, a private endpoint could be used to access the VPN gateway privately from on-premises via ExpressRoute or another VPN.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question