AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your company has an on-premises Windows service that exposes a custom TCP endpoint. You are building an Azure Logic App that needs to send data to this endpoint. Due to network security policies, you cannot open inbound ports in the firewall. You need to establish a secure bidirectional connection without configuring a VPN. Which Azure service should you use?
⚠ Common exam trap
Candidates often confuse Azure Relay with Azure API Management or Application Gateway, assuming they can handle arbitrary TCP traffic, but only Hybrid Connections provide the outbound-initiated tunnel required when inbound ports are blocked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Relay Hybrid Connections
Azure Relay Hybrid Connections enable secure bidirectional communication between on-premises services and cloud applications without opening inbound firewall ports. The on-premises service initiates an outbound connection to the Azure Relay over port 443 (HTTPS), and the Logic App sends data through the relay, which forwards it over the already-established outbound tunnel. This satisfies the requirement for a secure, bidirectional connection without VPN or inbound port exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure API Management with on-premises gateway
Why it's wrong here
Azure API Management is fundamentally designed for managing HTTP/HTTPS-based RESTful APIs, not arbitrary custom TCP protocols. While its self-hosted gateway can be deployed on-premises, it still expects inbound HTTP/HTTPS traffic to proxy to backend services. This setup would not support a custom TCP Windows service and would necessitate opening inbound firewall ports on-premises, which the question implies is undesirable or restricted.
- ✓
Azure Relay Hybrid Connections
Why this is correct
Azure Relay Hybrid Connections is the correct solution because it enables secure, bidirectional communication over any TCP-based protocol without requiring inbound firewall ports to be opened on the on-premises network. The on-premises Windows service establishes an outbound connection to the Azure Relay endpoint, allowing Azure services to then connect to the Relay and tunnel traffic back to the on-premises service. This "outbound-only" model is ideal for scenarios with strict on-premises network security policies.
- ✗
Azure Application Gateway with private link
Why it's wrong here
Azure Application Gateway is an HTTP/HTTPS load balancer and web application firewall, exclusively designed for Layer 7 (application layer) traffic. It cannot process or route custom TCP protocols, making it unsuitable for a generic TCP Windows service. While Azure Private Link provides private connectivity to Azure services, it doesn't alter Application Gateway's fundamental protocol limitations or enable it to handle non-HTTP/HTTPS traffic for the on-premises service.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute establishes a dedicated, private network connection between an on-premises network and Azure, bypassing the public internet. While it offers high bandwidth and low latency, it operates at the network layer (Layer 3) and does not inherently solve the problem of securely exposing a single on-premises custom TCP service without opening inbound firewall ports. Furthermore, ExpressRoute is a complex and costly solution typically used for large-scale network integration, making it overkill for a single service endpoint requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.