Two application VNets are deployed in different Azure regions. Each VNet uses a unique, non-overlapping address space. The application teams want private IP connectivity over the Microsoft backbone with the lowest possible latency between the regions. Which design should the administrator choose?

A site-to-site VPN between the two VNets.

A VPN would add unnecessary complexity and latency when Azure-native peering can provide direct private connectivity.

Azure Traffic Manager with two public endpoints.

Traffic Manager directs clients at the DNS layer and does not create private IP connectivity between VNets.

A service endpoint for each application subnet.

Service endpoints are for secure access to supported PaaS services, not VNet-to-VNet application traffic.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Global VNet peering. — Global VNet peering is designed for private communication between VNets in different Azure regions. It provides low-latency connectivity over the Microsoft backbone and does not require tunneling through a VPN gateway. Because the address spaces do not overlap, the VNets are eligible for peering. This makes global peering the best operational choice for regional application tiers that must communicate privately and efficiently. Why others are wrong: A site-to-site VPN works, but it is typically slower and more complex than native peering for Azure-to-Azure traffic. Traffic Manager is DNS-based and does not provide private network connectivity. Service endpoints are for PaaS resource access, not VNet-to-VNet traffic. The requirement is private communication between Azure regions, which directly maps to global VNet peering.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.