Implement and Manage Virtual Networking →mediumMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

You have two virtual networks in the same Azure region named VNet-App and VNet-DB. Resources in the two networks must communicate privately over the Azure backbone without using VPN gateways. What should you configure?

⚠ Common exam trap

It's easy for candidates to confuse network security groups (NSGs) or Azure Firewall as connectivity solutions, when they are only security controls that require an existing network path (like peering) to function.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Virtual network peering

Virtual network peering connects two Azure virtual networks in the same region via the Microsoft backbone infrastructure, enabling private IP communication without a VPN gateway or public internet. This is the correct solution because it meets the requirement for private, low-latency connectivity between VNet-App and VNet-DB using Azure's high-speed backbone.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Virtual network peering
Why this is correct
Virtual network peering is the native Azure connectivity mechanism for connecting two VNets in the same region. It creates a direct, private connection over the Microsoft backbone network, allowing resources in each VNet to communicate using private IP addresses without traversing the public internet, an Azure VPN gateway, or a virtual WAN. The connection is simple to configure, low-latency, and does not require a physical device or gateway, making it the correct answer.
✗
A site-to-site VPN
Why it's wrong here
A site-to-site VPN creates an encrypted IPSec tunnel through the public internet, typically used to connect an on-premises network to Azure or to link networks across different regions or locations. To use one between two VNets, each VNet would need a VPN gateway and an IPSec tunnel, adding cost, configuration complexity, and potential latency. While a VNet-to-VNet VPN could technically provide connectivity, it is an over-engineered, internet-dependent solution for two VNets in the same Azure region, which can be connected more directly and privately through VNet peering.
When this WOULD be correct
You need to connect an on-premises network to an Azure virtual network securely over the internet. A site-to-site VPN would be the correct choice for hybrid connectivity.
✗
A network security group
Why it's wrong here
A network security group is a stateful, distributed firewall that filters inbound and outbound traffic to and from Azure resources at the subnet or network-interface level. It only evaluates packets on an existing network path and defines allow/deny rules based on source/destination IP, port, and protocol. Placing an NSG on either VNet does not create a routing path or connectivity between the VNets; without VNet peering, a VPN gateway, or another link, the underlying networks remain separate and unreachable to each other.
When this WOULD be correct
You need to control inbound and outbound traffic to/from a subnet or network interface in a virtual network, such as allowing only specific ports or IP addresses.
✗
An Azure Firewall policy only
Why it's wrong here
An Azure Firewall policy in itself is a container for rule collections—NAT, network, and application rules—and it must be assigned to an Azure Firewall resource to enforce any filtering. It does not provide a physical or logical connection between virtual networks; even with a centralized firewall in a hub, traffic must first be directed from the spoke VNets into that hub via VNet peering or another connectivity mechanism. Therefore, a firewall policy alone does not establish the required path between the two VNets, making it incorrect for this scenario.
When this WOULD be correct
A question that asks: 'You need to centrally inspect and filter traffic between two peered virtual networks in the same region. What should you configure?' In that case, an Azure Firewall policy (with Azure Firewall deployed) would be correct to enforce security rules.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Virtual network peeringCorrect answer▾

Why this is correct

Virtual network peering is the native Azure connectivity mechanism for connecting two VNets in the same region. It creates a direct, private connection over the Microsoft backbone network, allowing resources in each VNet to communicate using private IP addresses without traversing the public internet, an Azure VPN gateway, or a virtual WAN. The connection is simple to configure, low-latency, and does not require a physical device or gateway, making it the correct answer.

✗A site-to-site VPNWrong answer — click to see why▾

Why this is wrong here

A site-to-site VPN requires a VPN gateway and connects on-premises networks to Azure, not two Azure virtual networks in the same region. It does not provide private communication over the Azure backbone without a gateway.

★ When this WOULD be the correct answer

You need to connect an on-premises network to an Azure virtual network securely over the internet. A site-to-site VPN would be the correct choice for hybrid connectivity.

Why candidates choose this

Candidates may confuse site-to-site VPN with VNet-to-VNet VPN, which can connect VNets but still requires VPN gateways, not the private backbone peering.

✗A network security groupWrong answer — click to see why▾

Why this is wrong here

Network security groups (NSGs) filter traffic but do not establish connectivity between virtual networks; they are not a connectivity solution.

★ When this WOULD be the correct answer

You need to control inbound and outbound traffic to/from a subnet or network interface in a virtual network, such as allowing only specific ports or IP addresses.

Why candidates choose this

Candidates may confuse traffic filtering with connectivity, thinking that allowing traffic via NSG rules is sufficient for cross-VNet communication.

✗An Azure Firewall policy onlyWrong answer — click to see why▾

Why this is wrong here

An Azure Firewall policy alone does not enable private connectivity between virtual networks; it only controls traffic filtering. To allow private communication over the Azure backbone, you need virtual network peering or a VPN gateway, not just a firewall policy.

★ When this WOULD be the correct answer

A question that asks: 'You need to centrally inspect and filter traffic between two peered virtual networks in the same region. What should you configure?' In that case, an Azure Firewall policy (with Azure Firewall deployed) would be correct to enforce security rules.

Why candidates choose this

Candidates may think that a firewall policy can establish connectivity because it controls traffic flow, but it only filters traffic; it does not create network links between VNets.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question