AZ-900 Describe Azure architecture and services Practice Question
Which Azure service enables you to securely connect remote users to Azure and on-premises resources using an SSL-based VPN?
⚠ Common exam trap
Many candidates confuse Azure VPN Gateway (which does support SSL-based P2S VPN) with Azure Application Gateway (a Layer 7 load balancer) or Azure Bastion (a secure RDP/SSH jump server), mistakenly thinking those services provide VPN connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure VPN Gateway
Azure VPN Gateway supports site-to-site, point-to-site, and VNet-to-VNet connections. Point-to-site (P2S) VPN uses SSTP (Secure Socket Tunneling Protocol) or IKEv2 VPN, and when configured with SSTP, it provides an SSL-based VPN tunnel (TCP port 443) that allows remote users to securely connect to Azure and on-premises resources through the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute creates a private, dedicated network connection between your on-premises infrastructure and Azure, routed through a connectivity provider rather than the public internet. It is designed for site-to-site hybrid connectivity with high bandwidth and reliability, not for individual remote users. Because it does not provide client-based SSL VPN termination for remote workers, it does not meet the requirement for an internet-based SSL VPN.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed PaaS service that provides secure browser-based RDP and SSH connectivity to your virtual machines directly in the Azure portal over TLS. It does not create an encrypted network tunnel for general site-to-site or point-to-site connectivity, nor does it allow remote users to reach an entire VNet as a VPN would. Bastion is specifically for accessing individual VM management ports without exposing public IP addresses, so it is not a VPN gateway.
- ✓
Azure VPN Gateway
Why this is correct
Azure VPN Gateway is the correct service because it provides encrypted IPsec/IKE site-to-site connections and point-to-site VPN options using SSTP, IKEv2, or OpenVPN over the public internet. For remote users, point-to-site SSTP/OpenVPN delivers the SSL VPN connectivity described in the question, allowing them to securely connect to an Azure VNet from anywhere. It acts as a virtual network gateway that enables both network-level and client-level encrypted connectivity.
- ✗
Azure Application Gateway
Why it's wrong here
Azure Application Gateway is a Layer-7 load balancer that routes HTTP/S traffic based on URL path, host headers, or cookie affinity, and it includes a Web Application Firewall (WAF) feature. Its purpose is to optimize and secure web application delivery, not to establish encrypted VPN tunnels or provide remote client connectivity. Because it lacks any VPN functionality, it cannot fulfill the SSL VPN requirement for remote users.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure VPN Gateway
A cloud-based virtual private network gateway in Microsoft Azure that securely connects on-premises networks to Azure virtual networks over encrypted tunnels.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.