AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  VNet peering between the administrators' home networks and Azure.

  Why it's wrong here

  VNet peering is a networking object that connects two virtual networks within Azure, enabling private IP connectivity between their resources. Administrators' home networks are not Azure virtual networks—they are on-premises networks with no VNet resource to peer—so you cannot peer them to an Azure VNet at all. Even if you tried to create a software VPN or a virtual network gateway on the home side, that would be a Site-to-Site VPN architecture, not VNet peering, and it would still require a router or gateway device at each home.

  When this WOULD be correct

  A question requiring connectivity between two Azure virtual networks in different regions or subscriptions, where you need to route traffic privately and without a VPN gateway.

• ✓

  A point-to-site VPN connection to an Azure VPN gateway.

  Why this is correct

  Point-to-site VPN is designed for individual client devices such as administrator laptops. It does not require a branch router or firewall, and it provides encrypted access into the Azure virtual network over the internet. This matches the need for per-user remote access to Azure VMs without standing up an on-premises VPN device.

• ✗

  An ExpressRoute circuit from each administrator's home internet connection.

  Why it's wrong here

  ExpressRoute is a dedicated private connection from an enterprise on-premises network to Azure, typically provisioned through a service provider with circuit bandwidth commitments and a physical or virtual cross-connect. It is designed for branch offices or data centers, not for individual home internet connections, and each administrator would need their own circuit with a provider—an impractical and expensive solution. ExpressRoute also does not inherently provide per-user authentication or per-device remote access; it simply extends a network, and it would fail to meet the secure, scalable remote-access requirement for home laptops.

  When this WOULD be correct

  A company has a branch office with a router that can connect to an ExpressRoute provider, and they need high-bandwidth, low-latency, and reliable connectivity to Azure for multiple users in that office. The question would specify a physical location with networking equipment.

• ✗

  A service endpoint enabled on the VM subnet.

  Why it's wrong here

  Service endpoints do not provide a remote-access path into a virtual network; they are an Azure networking feature that restricts outbound traffic from a subnet to specific PaaS services (such as Azure Storage or SQL Database) over the Microsoft backbone. Enabling a service endpoint on the VM subnet would only affect how VMs reach those PaaS resources, and it does not create any inbound VPN tunnel from a remote laptop to the VMs. Therefore, it cannot solve secure remote administration from home.

  When this WOULD be correct

  A question requiring secure, private access from an Azure VNet to an Azure Storage account, bypassing the public internet, with the constraint that the storage account uses a service endpoint and firewall rules to allow only traffic from that VNet.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question