AZ-900 Describe Azure architecture and services Practice Question
Which Azure networking service provides a private connection from an on-premises network to Azure without using the public internet?
⚠ Common exam trap
Candidates often confuse Azure VPN Gateway with ExpressRoute because both provide site-to-site connectivity, but VPN Gateway uses the public internet while ExpressRoute is a private, dedicated connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute is the correct answer because it establishes a dedicated, private connection from an on-premises network directly into Azure, bypassing the public internet entirely. This is achieved through a Layer 3 BGP peering session over a provider-managed circuit, ensuring low latency, higher reliability, and data does not traverse the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway creates site-to-site or point-to-site encrypted IPsec/IKE tunnels over the public internet, enabling connectivity between on-premises networks and Azure VNets. Although it is a legitimate hybrid connection method, it is not a dedicated private connection—it relies on shared public infrastructure and has variable latency/throughput, and it does not offer the same Service Level Agreements as ExpressRoute. Therefore, for a dedicated private connection, VPN Gateway is not the correct choice.
- ✓
Azure ExpressRoute
Why this is correct
ExpressRoute is a dedicated, private network connection provided by Microsoft through a connectivity provider, establishing a direct link from your on-premises infrastructure to Azure without traversing the public internet. This service offers higher bandwidth, lower and more consistent latency, and stronger SLA guarantees compared to internet-based connections, making it the correct answer for scenarios requiring reliable, private connectivity.
- ✗
Azure Virtual Network
Why it's wrong here
Azure Virtual Network (VNet) is the fundamental building block for your private network inside Azure, enabling resources like VMs to securely communicate with each other, the internet, and on-premises networks—but it is not itself a connection service. A VNet acts as the network boundary or container where subnets and firewalls define traffic rules; to actually connect from on-premises, you must pair it with an external mechanism such as ExpressRoute or VPN Gateway, which is why VNet alone does not provide the required connectivity.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly through the Azure portal, using TLS and your browser without needing a public IP on the VM. While it enhances security for administrative access, it is designed for connecting external users to Azure VMs over the public internet, not for connecting a customer's on-premises datacenter to Azure resources, making it incorrect for this question.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Reliability
Reliability is the measure of a system's ability to consistently perform its intended functions without failure over a specified period of time under stated conditions.
Key term
Azure ExpressRoute
Azure ExpressRoute is a dedicated, private, and high-speed network connection from your on-premises data center to Microsoft's cloud, bypassing the public internet for better reliability, security, and performance.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.