AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a private, isolated section of the Azure cloud where you can launch Azure resources in a virtual network you define?
⚠ Common exam trap
Many exam-takers confuse Azure Virtual WAN or ExpressRoute as the service that provides isolated virtual networks, when in fact those services are connectivity and aggregation tools that operate on top of or alongside VNets, not the foundational isolation layer itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Virtual Network (VNet)
Azure Virtual Network (VNet) is the correct answer because it provides a logically isolated section of the Azure cloud dedicated to your subscription. Within a VNet, you can define your own private IP address space (using RFC 1918 addresses), subnets, and routing policies, and then launch Azure resources such as virtual machines, App Service Environments, and Azure Kubernetes Service clusters into that private network. This isolation is achieved through network segmentation and is the fundamental building block for private connectivity in Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single operational hub, aimed at large-scale distributed architectures. It is not a foundational private network where resources are directly deployed; rather, it relies on Virtual Network spokes to host workloads. The VNet itself remains the core isolation boundary and address-space container, whereas Virtual WAN provides a broader connectivity fabric over many VNets.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute creates a private, dedicated connection between an on-premises environment and Azure data centers, bypassing the public internet entirely. It enables hybrid scenarios by extending corporate networks into Azure, but it does not define the logical network space inside Azure. ExpressRoute terminates into a Virtual Network gateway on a VNet, so the VNet is the underlying private network service, not ExpressRoute itself.
- ✓
Azure Virtual Network (VNet)
Why this is correct
Azure Virtual Network is the logical, software-defined network that represents your own isolated slice of the Azure cloud. Through the VNet, you define private IP address spaces and carve out subnets for placing virtual machines, load balancers, and other resources, while controlling traffic with route tables and network policies. It is the fundamental building block for Azure networking, much like a traditional VLAN concept on a global scale.
- ✗
Azure Network Security Group
Why it's wrong here
A Network Security Group is a security rules collection that filters inbound and outbound traffic between the VNet, subnets, and network interfaces, allowing or denying connections based on source, destination, and port. It has no address-space or subnet-definition capability; it is applied to an existing VNet or subnet to enforce security policy. Thus, it is a control plane or security layer inside a VNet, not the network fabric that defines the private address space.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.