How to Encrypt Traffic Between Peered Azure VNets Using Virtual Network Encryption
A company has two Azure virtual networks (VNet-A and VNet-B) connected via VNet peering. They need to ensure that all traffic between the two VNets is encrypted using IPsec and that no traffic can bypass the encryption. The security team has enabled the 'Use remote virtual network gateways' setting on the peering. However, traffic is still flowing unencrypted. What additional configuration is required to enforce encryption for all traffic between the VNets?
Quick Answer
The correct answer is to enable Azure virtual network encryption on both VNets and configure the encryption policy. This is required because Azure Virtual Network Encryption operates at the infrastructure level, encrypting all traffic between peered VNets using IPsec without needing a VPN gateway, and it enforces encryption so no traffic can bypass it. The 'Use remote virtual network gateways' setting only permits transit routing through a remote gateway, but it does not encrypt traffic itself, which is why unencrypted traffic persists. On the AZ-500 exam, this question tests your understanding of platform-level encryption versus gateway-based solutions, and a common trap is confusing gateway settings with actual encryption enforcement. Remember: gateway settings enable routing, not encryption—think of VNet encryption as a mandatory "encrypt-all" switch at the network fabric layer. A useful memory tip is "Gateways route, encryption encrypts—enable VNet encryption to lock the pipe."
⚠ Common exam trap
Test-takers frequently assume that enabling 'Use remote virtual network gateways' on VNet peering automatically encrypts traffic, when in fact it only allows gateway transit and does not provide any encryption; the real solution is Azure Virtual Network Encryption, which is a separate feature that must be explicitly enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Azure virtual network encryption' on both VNets and configure the encryption policy.
Azure Virtual Network Encryption provides a platform-level encryption mechanism that encrypts all traffic between virtual networks, including VNet peering traffic, without requiring a VPN gateway. Enabling this feature on both VNets and configuring the encryption policy ensures that all inter-VNet traffic is encrypted using IPsec, and since it is enforced at the infrastructure level, no traffic can bypass the encryption. The 'Use remote virtual network gateways' setting alone does not encrypt traffic; it only allows a VNet to use a remote gateway for transit routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Azure virtual network encryption' on both VNets and configure the encryption policy.
Why this is correct
Azure virtual network encryption (currently in preview) encrypts all traffic between VNets using IPsec. Enabling it on both sides ensures traffic is encrypted.
- ✗
Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.
Why it's wrong here
This would create encrypted tunnels, but it introduces additional cost and complexity. Also, the connection would be through the gateways, not directly between VNets. It may not cover all traffic if there are multiple spoke VNets.
- ✗
Configure a network security group (NSG) rule on each subnet to deny traffic that is not IPsec encapsulated.
Why it's wrong here
NSGs work at layer 3/4 and cannot inspect IPsec encapsulation. This is not feasible.
- ✗
Enable 'Allow gateway transit' on VNet-A and 'Use remote virtual network gateways' on VNet-B, and then create a VPN gateway in VNet-A.
Why it's wrong here
This configuration enables transitive routing via a gateway, but does not encrypt the traffic between the VNets over peering. The gateway would only encrypt traffic going through it, but traffic between the VNets may still use the peering direct path unencrypted.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has multiple Azure virtual networks connected via VNet peering. They want to ensure that all traffic between the peered VNets is encrypted and that no traffic can bypass the encryption. Which configuration is required?
hard- A.Enable Service Endpoint Policies
- ✓ B.Use VPN Gateway with IPsec between VNets
- C.VNet peering does not support encryption; use Global VNet peering
- D.Enable Azure Firewall
Why B: VNet peering does not encrypt traffic between virtual networks by default. To enforce encryption for all traffic, you must use a VPN Gateway with IPsec/IKE policy configured between the peered VNets. This ensures that all traffic crossing the peering is encrypted and that no unencrypted path exists, meeting the requirement that no traffic can bypass encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.