AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A subnet named GatewaySubnet and a public IP address for the VPN gateway.

  Why this is correct

  Azure VPN gateways require a dedicated GatewaySubnet, which must be created within the virtual network with a name exactly 'GatewaySubnet', and at least one public IP address for the VPN gateway that serves as the endpoint for on-premises VPN devices. This public IP is assigned to the gateway and provides the external IP that the on-premises VPN device connects to. Without these, the gateway cannot be deployed or establish site-to-site tunnels. Also note that the public IP should be in the Basic or Standard SKU depending on gateway SKU, and it must be a dynamic allocation for Basic gateways.

• ✗

  A subnet named AzureBastionSubnet and a static private IP address.

  Why it's wrong here

  AzureBastionSubnet is specifically required when deploying Azure Bastion, a managed jump host service, not for VPN gateways. A VPN gateway requires a GatewaySubnet (and a public IP) but does not need a static private IP; the gateway uses dynamic private IP allocation from the GatewaySubnet range. A static private IP is not a required or supported configuration for a VPN gateway, and using BastionSubnet would cause placement errors during gateway deployment.

  When this WOULD be correct

  When deploying Azure Bastion for secure RDP/SSH access to VMs, you must create a subnet named AzureBastinSubnet with a /27 or larger address range. The Bastion service uses a public IP, but the subnet itself does not require a static private IP.

• ✗

  A network security group attached directly to the virtual network gateway.

  Why it's wrong here

  Network security groups (NSGs) are not applied directly to a virtual network gateway. Azure does not support attaching an NSG to the gateway subnet or gateway resource; if you attempt to apply an NSG to the GatewaySubnet, the gateway may stop functioning or fail to provision. Instead, traffic flow is controlled by route tables and the gateway's inherent security; NSGs are typically applied to other subnets for protecting workloads, not to the gateway itself.

  When this WOULD be correct

  In a scenario where you need to restrict inbound traffic to a subnet containing a virtual network gateway (e.g., to limit management access from specific IPs), you would associate an NSG with the GatewaySubnet. The question would ask: 'How can you secure the gateway subnet?'

• ✗

  A load balancer with a public frontend to terminate the VPN connection.

  Why it's wrong here

  Azure VPN gateways do not rely on a load balancer for tunnel termination. A VPN gateway is a dedicated virtual network gateway resource that natively handles IPsec/IKE tunnels; a load balancer with a public frontend is used for distributing traffic to VM instances (e.g., for web apps) and cannot terminate VPN tunnels or route IPsec traffic. Adding a load balancer would not satisfy the gateway deployment requirements and would create an unsupported architecture.

  When this WOULD be correct

  For a highly available site-to-site VPN deployment using active-active mode with multiple on-premises devices, you might deploy a load balancer in front of the VPN gateways to distribute traffic, but this is not a standard requirement for a basic gateway creation.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question