AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploy a VPN gateway and configure both site-to-site and point-to-site connections.

  Why this is correct

  A VPN gateway supports both site-to-site tunnels for the office network and point-to-site access for individual users. This single design meets the hybrid branch requirement and the remote-user requirement without exposing the VNet directly to the internet. It is the standard Azure networking choice when you need encrypted connectivity from both networks and individual clients.

• ✗

  Use VNet peering between the office network and Azure, then share the same connection with remote users.

  Why it's wrong here

  VNet peering is a Layer 3 connection between Azure virtual networks, not between on-premises and Azure. It relies on the Microsoft backbone and does not create an encrypted tunnel, nor does it provide any client VPN capability for traveling users. You would still need a VPN gateway to connect the office network, and a separate point-to-site configuration for remote laptops—so this option fails both requirements.

  When this WOULD be correct

  A question asks: 'You need to connect two Azure virtual networks in different regions with low-latency, private IP communication. Which solution should you use?' In that case, VNet peering is the correct answer.

• ✗

  Create a service endpoint to the virtual network and enable private access for laptops.

  Why it's wrong here

  Service endpoints are designed to secure access to Azure PaaS services (like Storage or SQL Database) from a virtual network, not to extend network connectivity to on-premises or remote users. They do not establish any encrypted tunnel for the office network, nor do they authenticate individual laptops. Simply enabling a service endpoint gives no path for a traveling user's laptop to reach Azure VMs or other private resources.

  When this WOULD be correct

  A question requiring secure access from an on-premises network to Azure PaaS services (e.g., Azure Storage or SQL Database) without traversing the public internet, while also needing private access for laptops. For example: 'Your company needs to connect its on-premises network to Azure Storage and also allow remote employees to access the storage privately. Which solution should you use?'

• ✗

  Deploy a NAT gateway and use it for secure office and laptop connectivity.

  Why it's wrong here

  A NAT gateway is an outbound-only connectivity tool that translates private source IP addresses from VMs to a public IP address. It provides no inbound site-to-site VPN capability, no point-to-site remote access, and no encryption or user authentication. Deploying a NAT gateway would not connect the office network to Azure and would not give laptops secure access—it is irrelevant for hybrid connectivity and remote-user connectivity.

  When this WOULD be correct

  A question requiring outbound internet access for Azure resources with source network address translation (SNAT) to a single public IP, while minimizing the number of public IPs used. For example: 'You need to enable outbound internet connectivity for multiple VMs in a subnet using a single public IP address.'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question