AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure VPN Gateway: Connect on-premises network to Azure storage account over the internet using an encrypted tunnel

  Why this is correct

  Azure VPN Gateway creates a site-to-site (S2S) IPsec/IKE tunnel that sends encrypted traffic from your on-premises network to an Azure virtual network over the public internet. Because encryption protects the payload, you can securely reach a storage account's service endpoint or private endpoint even though the connection path crosses internet routers. This is fundamentally different from a dedicated private connection: the underlying transport is the internet, not a private carrier-grade link.

• ✓

  Azure ExpressRoute: Connect on-premises network to Azure storage account with a dedicated private connection that does not traverse the internet

  Why this is correct

  Azure ExpressRoute establishes a private, dedicated logical connection between your on-premises infrastructure and Azure through a carrier-partner or direct peering, with traffic that never traverses the public internet. This delivers SLAs on availability, lower latency, and higher bandwidth than VPN-based connections. For storage, ExpressRoute can use Microsoft peering or private peering with a private endpoint to reach the storage account without routing over the internet.

• ✓

  Azure Private Link: Access Azure SQL Database privately from a virtual network, ensuring traffic never leaves the Microsoft network

  Why this is correct

  Azure Private Link exposes a PaaS service, such as Azure SQL Database, as a private endpoint with its own IP address inside your virtual network. Traffic from your VNet to the service is routed entirely over the Microsoft backbone, never the public internet, and you can restrict the service's public access. This is a network-level isolation mechanism, distinct from DNS or hybrid WAN solutions.

• ✓

  DNS CNAME record: Map a custom domain name to an Azure App Service endpoint

  Why this is correct

  A DNS CNAME record maps one hostname to another hostname, so you can point your custom domain (e.g., www.contoso.com) to the Azure App Service's default *.azurewebsites.net endpoint. App Service rejects the custom domain until you create and validate the CNAME (or TXT/A record for apex domains), and the mapping affects only DNS resolution, not the network path. This is a configuration task, not a networking service.

• ✗

  Azure VPN Gateway: Connect on-premises network to Azure storage account with a dedicated private connection that does not traverse the internet

  Why it's wrong here

  This description is incorrect because Azure VPN Gateway does not deliver a dedicated private connection; it always uses the public internet as the transport medium for its encrypted IPsec/IKE tunnels. A dedicated private connection that bypasses the internet is the hallmark of Azure ExpressRoute, not VPN Gateway. VPN Gateway tunnels are encrypted and secure but share the internet's routing infrastructure and lack ExpressRoute's guaranteed latency and bandwidth commitments.

• ✗

  Azure Private Link: Map a custom domain name to an Azure App Service endpoint

  Why it's wrong here

  This statement incorrectly attributes a DNS feature to Azure Private Link. Mapping a custom domain name to an Azure App Service endpoint is performed with a CNAME (or TXT record for apex domains) in your DNS zone, not through Private Link. Private Link's purpose is to provide private IP connectivity from a virtual network to PaaS services, and it has no role in custom domain mapping.

Go deeper

Related to this question