AZ-500 Secure networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  IPSec (Internet Protocol Security)

  Why this is correct

  Azure site-to-site VPN tunnels rely on IPSec in tunnel mode to encrypt and authenticate every packet crossing the connection. IPSec uses the Internet Key Exchange (IKE) protocol to negotiate security associations, then applies Encapsulating Security Payload (ESP) for confidentiality and integrity. Because IPSec operates at the network layer (Layer 3), it transparently protects all IP payloads between the on-premises gateway and the Azure VPN gateway. This makes IPSec the mandatory protocol for Azure VPN site-to-site configurations, not SSL/TLS or other application-layer protocols.

• ✗

  SSL (Secure Sockets Layer) / TLS (Transport Layer Security)

  Why it's wrong here

  SSL/TLS is a transport-layer security protocol that protects application-specific data such as HTTP, SMTP, or FTP by establishing encrypted channels between clients and servers. However, it does not encapsulate entire IP packets or route traffic between distinct networks, which is what a site-to-site VPN requires. Azure's VPN gateway does not support SSL/TLS as a tunnel protocol for site-to-site connections; instead, SSL/TLS appears in point-to-site solutions like Microsoft Entra ID App Proxy or HTTPS-based tunneling, but not for the inter-network gateway tunnels described here. Thus, SSL/TLS is the wrong protocol for encrypting a full site-to-site IP payload stream.

• ✗

  SSH (Secure Shell)

  Why it's wrong here

  SSH is an authenticated and encrypted application-layer protocol designed for remote shell access, command execution, and secure file copy using SFTP/SCP. It encrypts just the data within an SSH session, not arbitrary IP traffic flowing between two network gateways. SSH tunnels (port forwarding) can forward specific TCP ports, but they cannot dynamically carry the full routed IP traffic of an entire site-to-site VPN footprint. Azure VPN gateways do not use SSH for tunnel encapsulation, making it an incorrect choice for this scenario.

• ✗

  PGP (Pretty Good Privacy)

  Why it's wrong here

  PGP (Pretty Good Privacy) is an asymmetric cryptographic system used for encrypting and digitally signing data at rest, typically email messages and files. It applies public-key cryptography to individual data objects, not to continuous network packet streams. PGP has no mechanism for encapsulating IP packets, negotiating dynamic security associations, or supporting gateway-to-gateway routing that a site-to-site VPN requires. Consequently, PGP is fundamentally unsuited for encrypting network-level traffic between on-premises and Azure networks.

Go deeper

Related to this question