AZ-305 Design infrastructure solutions Practice Question
A healthcare organization is migrating a regulatory-compliant application to Azure. The application must be isolated from the internet and accessible only from on-premises networks via a private IP address. The solution must minimize latency and maximize throughput for large data transfers. Which Azure networking solution should the organization implement?
⚠ Common exam trap
It's easy for candidates to confuse Azure Private Link (which provides private access to PaaS services) with a private network connection from on-premises, overlooking that Private Link still requires an underlying connectivity method like ExpressRoute or VPN for on-premises access, and does not itself guarantee low latency or high throughput for large transfers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute provides a dedicated private connection from on-premises networks to Azure, bypassing the public internet. This ensures the application is isolated from the internet, uses private IP addresses, and offers the lowest latency and highest throughput for large data transfers due to dedicated bandwidth and no internet congestion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Private Link
Why it's wrong here
Azure Private Link provides private connectivity from a virtual network directly into specific Azure PaaS services (such as Storage or SQL DB) using a private endpoint IP address, but it does not establish any site-to-site connection between an on-premises network and Azure. To reach that private endpoint from on-premises, you must first have an ExpressRoute or VPN connection to the Azure VNet, so Private Link alone cannot satisfy the requirement for dedicated, high-throughput data transfer. Therefore, this option is incorrect for the scenario.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway creates encrypted IPSec tunnels over the public internet, which means traffic is subject to internet routing variability, potential latency spikes, and throughput limits that depend on the gateway SKU and link quality. Even the highest-performance VPN Gateway SKUs typically offer lower and less consistent throughput than a dedicated ExpressRoute circuit, which may not meet the organization's need for reliable, large-scale regulatory file transfers. Hence, VPN Gateway is not the best-suited answer here.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a networking orchestration service that simplifies the creation and management of a hub-and-spoke topology, but it does not by itself deliver any physical or private network connectivity. When connecting on-premises to Azure, Virtual WAN must be paired with an actual transport mechanism such as an ExpressRoute circuit or site-to-site VPN; without ExpressRoute, any data transfer still traverses the public internet. Because the question asks for the specific service that provides the private, low-latency link, Virtual WAN is not the correct answer.
- ✓
Azure ExpressRoute
Why this is correct
Azure ExpressRoute establishes a dedicated private connection between an on-premises network and Azure through a telecommunications provider, completely bypassing the public internet and providing consistent lower latency, higher throughput, and a guaranteed SLA. This makes it the preferred choice for healthcare organizations that need to transfer large volumes of sensitive regulatory data reliably and securely. ExpressRoute also supports private peering for services such as virtual machines, and optional Microsoft peering for Azure PaaS, making it the right solution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.