AZ-500 Secure networking Practice Question
You need to securely connect an on-premises network to an Azure virtual network. The connection must use the internet and provide authenticated and encrypted communication. Which Azure service should you use?
⚠ Common exam trap
Many candidates confuse Azure VPN Gateway with Azure ExpressRoute, thinking both provide encrypted connections, but ExpressRoute does not use the internet and encryption is optional (not default), while the question explicitly requires internet-based encrypted communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure VPN Gateway
Azure VPN Gateway is the correct choice because it creates an encrypted site-to-site VPN connection over the internet using IPsec/IKE protocols. This meets the requirement for authenticated and encrypted communication between an on-premises network and an Azure virtual network without needing a dedicated private link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure VPN Gateway
Why this is correct
Azure VPN Gateway is the correct service because it establishes a site-to-site IPsec/IKE VPN tunnel over the standard internet, providing encrypted connectivity between your on-premises VPN device and the Azure virtual network. It supports both policy-based and route-based gateways, and can be deployed in active-active mode for high availability, making it ideal for a secure, single-site connection without dedicated circuits.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute creates a private, dedicated connection from your on-premises network to Azure through a service provider, bypassing the internet entirely. While it offers lower latency, higher bandwidth, and a private link with an availability SLA, it requires physical infrastructure, carrier involvement, and long-term commitment, which is more than the scenario needs for a straightforward secure site-to-site VPN connection.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a Layer 7 load balancer that routes HTTP/HTTPS traffic to backend pools, with features such as URL-based routing, SSL termination, and Web Application Firewall (WAF) integration. It does not implement IPsec tunnels or provide any site-to-site virtual private network capability, so it is entirely unsuitable for connecting an on-premises network to Azure. Its role is application traffic distribution, not hybrid network connectivity.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is incorrect because the scenario describes a single on-premises network connecting to one Azure virtual network. Virtual WAN is designed for large-scale, global network architectures, centralising connectivity for numerous branch offices and multiple Azure VNets. It is tempting because it supports VPN connections over the internet, but its primary purpose is simplifying complex, distributed network topologies, not a single point-to-point connection.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.