AZ-500 Secure networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Point-to-Site

  Why this is correct

  Azure VPN Gateway's Point-to-Site method allows individual client computers to establish a secure connection to a VNet from any location, using SSTP, IKEv2, or OpenVPN protocols. Each client authenticates via certificates or Microsoft Entra ID, and traffic is wrapped in IPsec for IKEv2/OpenVPN or SSL/TLS for SSTP. It is one of the two primary VPN connection methods, distinct from Site-to-Site because it does not require a public-facing VPN device on the customer side.

• ✗

  VNet-to-VNet

  Why it's wrong here

  VNet-to-VNet is not a distinct VPN gateway connection method; it's a configuration that connects two Azure VNets using the same IPsec/IKE Site-to-Site protocol. You create VPN gateways in both VNets and establish a Site-to-Site connection between them, optionally with BGP for dynamic routing. Because it relies on the S2S mechanism, it is considered a scenario of Site-to-Site rather than a separate method listed by the VPN gateway.

• ✓

  Site-to-Site

  Why this is correct

  Site-to-Site creates an IPsec/IKE tunnel between an on-premises VPN device and the Azure VPN gateway, enabling the entire on-premises network to securely communicate with the VNet as if it were directly attached. Configuration requires a public IP on the local VPN device, a pre-shared key, and typically a BGP or static route. This method is one of the two valid connection methods; it is distinct from P2S because it aggregates whole networks rather than individual client sessions.

• ✗

  Azure Bastion

  Why it's wrong here

  Azure Bastion is a fully managed platform service that provides secure, seamless RDP and SSH access to virtual machines directly in the Azure portal over TLS, without requiring a public IP address on the VM. It acts as a jump host brokering connections, not as a VPN tunnel that encrypts all traffic between a network and Azure. Therefore it cannot be used as a VPN gateway connection method, as it serves a completely different remote-access purpose.

• ✗

  ExpressRoute

  Why it's wrong here

  ExpressRoute creates a private, dedicated network connection from on-premises infrastructure to Azure through a connectivity provider, bypassing the public internet entirely. It does not use IPsec or any VPN tunneling protocol and is implemented with an ExpressRoute gateway, not a VPN gateway. Although often used alongside a VPN gateway for failover, it is a separate networking service rather than a VPN connection method.

Go deeper

Related to this question