AZ-900 Describe Azure architecture and services Practice Question
A company has an on-premises data center with a site-to-site VPN connection to Azure. The company wants to ensure that the connection remains secure by encrypting all traffic between the on-premises network and Azure virtual network. The connection must be established over the public internet. Which Azure service should the company use to create this encrypted tunnel?
⚠ Common exam trap
Many exam-takers confuse Azure ExpressRoute as a secure option because it is private, but it does not encrypt traffic by default and does not use the public internet, which is explicitly required in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure VPN Gateway
Azure VPN Gateway is the correct service because it creates an encrypted site-to-site VPN tunnel over the public internet using IPsec/IKE protocols. This meets the requirement for a secure connection between the on-premises data center and Azure virtual network over the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute provides a dedicated private connection from on-premises to Azure that bypasses the public internet. It offers higher reliability and lower latency but does not use encryption by default and is more expensive. It is not the service for creating an encrypted tunnel over the internet.
When this WOULD be correct
A company needs a high-speed, low-latency, private connection to Azure that does not traverse the public internet, and is willing to work with a connectivity provider. The question would specify that the connection must be private and not use the public internet.
- ✓
Azure VPN Gateway
Why this is correct
Azure VPN Gateway is the correct answer. It creates a site-to-site VPN connection that encrypts traffic using IPsec/IKE protocols over the public internet. It is designed to securely connect on-premises networks to Azure virtual networks.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a hub-and-spoke networking service that can manage multiple VPN connections and branches. While it can use VPN Gateway connections, it is overkill for a simple site-to-site VPN and adds unnecessary complexity and cost. The basic VPN Gateway is the appropriate service for this requirement.
When this WOULD be correct
A company has multiple branch offices and wants to connect them all to Azure and to each other using a single managed service, with built-in routing and security policies. The question would ask for a service that provides a unified WAN architecture connecting branches to Azure and between branches over the Microsoft network.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion provides secure and seamless RDP and SSH connectivity to virtual machines directly through the Azure portal. It does not create a network-to-network connection or encrypt traffic between on-premises and Azure; it is used for individual VM access.
When this WOULD be correct
A company needs to securely connect to Azure virtual machines from the Azure portal without using public IP addresses, while preventing exposure to the internet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure VPN GatewayCorrect answer▾
Why this is correct
Azure VPN Gateway is the correct answer. It creates a site-to-site VPN connection that encrypts traffic using IPsec/IKE protocols over the public internet. It is designed to securely connect on-premises networks to Azure virtual networks.
✗Azure ExpressRouteWrong answer — click to see why▾
Why this is wrong here
Azure ExpressRoute provides a private, dedicated connection to Azure that bypasses the public internet, but the question explicitly requires the connection to be established over the public internet. ExpressRoute does not use the public internet and thus cannot meet this requirement.
★ When this WOULD be the correct answer
A company needs a high-speed, low-latency, private connection to Azure that does not traverse the public internet, and is willing to work with a connectivity provider. The question would specify that the connection must be private and not use the public internet.
Why candidates choose this
Candidates may confuse ExpressRoute as a secure connection option, but they overlook the key constraint that the connection must be over the public internet. ExpressRoute is often associated with security and reliability, making it tempting for those who do not read the question carefully.
✗Azure Virtual WANWrong answer — click to see why▾
Why this is wrong here
Azure Virtual WAN is a networking service that provides optimized and automated branch-to-branch connectivity through Azure, but it does not itself create a site-to-site VPN tunnel; it can orchestrate VPN connections using Azure VPN Gateway or third-party NVAs, but the question specifically asks for the service to create the encrypted tunnel, which is the VPN Gateway.
★ When this WOULD be the correct answer
A company has multiple branch offices and wants to connect them all to Azure and to each other using a single managed service, with built-in routing and security policies. The question would ask for a service that provides a unified WAN architecture connecting branches to Azure and between branches over the Microsoft network.
Why candidates choose this
Candidates may confuse Virtual WAN's ability to manage VPN connections as being the service that directly creates the VPN tunnel, rather than understanding that Virtual WAN orchestrates connectivity but relies on VPN Gateway or other components for the actual encrypted tunnel.
✗Azure BastionWrong answer — click to see why▾
Why this is wrong here
Azure Bastion provides secure RDP/SSH access to Azure VMs without exposing public IPs, but it does not create encrypted site-to-site VPN tunnels over the public internet.
★ When this WOULD be the correct answer
A company needs to securely connect to Azure virtual machines from the Azure portal without using public IP addresses, while preventing exposure to the internet.
Why candidates choose this
Candidates may confuse 'secure connection' with Bastion's secure remote access, not realizing it is for VM access, not site-to-site networking.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
Key term
Azure VPN Gateway
A cloud-based virtual private network gateway in Microsoft Azure that securely connects on-premises networks to Azure virtual networks over encrypted tunnels.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.