AZ-900 Describe Azure architecture and services Practice Question
A company runs a critical application on-premises and plans to extend its data center to Azure. The company needs a dedicated, private network connection between the on-premises network and Azure that bypasses the public internet. The connection must provide higher bandwidth and more reliable, lower-latency connectivity than a site-to-site VPN. The company also requires a Service Level Agreement (SLA) for the connection's availability. Which Azure service should the company use?
⚠ Common exam trap
Test-takers frequently confuse Azure Virtual WAN as a direct replacement for ExpressRoute, but Virtual WAN is a hub-and-spoke architecture that can include ExpressRoute circuits, not a private connection service itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute is the correct choice because it provides a dedicated, private network connection from on-premises to Azure that bypasses the public internet entirely. It offers higher bandwidth, lower latency, and more reliable connectivity than a site-to-site VPN, and it includes a financially backed SLA for availability (typically 99.95% or higher). This makes it ideal for critical applications requiring consistent, private, and high-performance connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway sends encrypted traffic over the public internet. It does not provide a dedicated private connection and typically offers lower bandwidth and higher latency compared to ExpressRoute. It also does not offer the same SLA for availability.
When this WOULD be correct
A company needs to connect on-premises to Azure securely over the internet with encrypted traffic, and the primary requirements are cost-effectiveness and ease of setup rather than dedicated private bandwidth or an availability SLA.
- ✓
Azure ExpressRoute
Why this is correct
Azure ExpressRoute establishes a dedicated, private Layer 2/Layer 3 connection between an organization's on-premises infrastructure and Azure via a connectivity provider, with no traffic traversing the public internet. This connection offers higher bandwidth, lower latency, and stronger security than internet-based links, plus a 99.95% availability SLA at the connectivity level when configured with redundancy. These characteristics directly satisfy the scenario's need for a reliable, high-performance, private path for a critical application. ExpressRoute also supports global reach and multiple peering options, making it the definitive solution for hybrid networking requirements.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a networking service that brings together various connectivity options like VPN and ExpressRoute into a unified hub. However, it is not the dedicated private connection itself; the underlying private connectivity would still be provided by ExpressRoute.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a layer 7 reverse proxy and load balancer designed to route HTTP/HTTPS traffic based on URLs, cookies, or host headers to backend web pools. It has no role in establishing WAN connectivity between an existing on-premises data center and Azure; it operates entirely inside an Azure virtual network and requires an underlying connectivity path like ExpressRoute, VPN, or public internet to be reachable. Therefore, selecting Application Gateway would fail to provide any private, dedicated link for the critical on-premises app, and it cannot satisfy the SLA or data-path requirements in the scenario. Its purpose is application delivery and traffic management, not site-to-site networking.
When this WOULD be correct
A company needs to securely route and load balance HTTP/HTTPS traffic to web applications running on Azure, with features like SSL termination, URL-based routing, and a web application firewall (WAF) to protect against common web vulnerabilities. The question would specify application-layer requirements rather than network connectivity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure ExpressRouteCorrect answer▾
Why this is correct
Azure ExpressRoute establishes a dedicated, private Layer 2/Layer 3 connection between an organization's on-premises infrastructure and Azure via a connectivity provider, with no traffic traversing the public internet. This connection offers higher bandwidth, lower latency, and stronger security than internet-based links, plus a 99.95% availability SLA at the connectivity level when configured with redundancy. These characteristics directly satisfy the scenario's need for a reliable, high-performance, private path for a critical application. ExpressRoute also supports global reach and multiple peering options, making it the definitive solution for hybrid networking requirements.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway uses the public internet for connectivity and does not provide a dedicated private connection, so it cannot bypass the public internet or offer the higher bandwidth, lower latency, and SLA required for this critical application.
★ When this WOULD be the correct answer
A company needs to connect on-premises to Azure securely over the internet with encrypted traffic, and the primary requirements are cost-effectiveness and ease of setup rather than dedicated private bandwidth or an availability SLA.
Why candidates choose this
Candidates may confuse site-to-site VPN with a private connection, or assume VPN Gateway can meet high-bandwidth and low-latency needs because it is a common hybrid connectivity solution.
✗Azure Application GatewayWrong answer — click to see why▾
Why this is wrong here
Azure Application Gateway is a Layer 7 load balancer and web application firewall, not a dedicated private network connection. It does not provide a private, high-bandwidth, low-latency connection that bypasses the public internet, nor does it offer an SLA for connection availability.
★ When this WOULD be the correct answer
A company needs to securely route and load balance HTTP/HTTPS traffic to web applications running on Azure, with features like SSL termination, URL-based routing, and a web application firewall (WAF) to protect against common web vulnerabilities. The question would specify application-layer requirements rather than network connectivity.
Why candidates choose this
Candidates may confuse 'Application Gateway' with 'Gateway' in VPN Gateway, assuming it provides network connectivity. The term 'Gateway' is misleading, and the focus on 'connection' and 'SLA' might make them think of any gateway service.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure ExpressRoute
Azure ExpressRoute is a dedicated, private, and high-speed network connection from your on-premises data center to Microsoft's cloud, bypassing the public internet for better reliability, security, and performance.
Key term
SLA
A Service Level Agreement (SLA) is a contract between a service provider and a customer that defines the level of service expected, including metrics like uptime, response time, and penalties for non-compliance.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.