AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure ExpressRoute

  Why it's wrong here

  Azure ExpressRoute provides private, dedicated connectivity from a customer network to Azure through a third-party connectivity provider, crossing the Microsoft network over private lines rather than the public internet. It offers more consistent latency, higher bandwidth, and a 99.95% SLA, but it is not internet-based and cannot be described as an encrypted connection over the internet. ExpressRoute is an alternative for critical workloads requiring guaranteed performance, but the scenario calls for internet-based encrypted tunneling. Moreover, ExpressRoute traffic is typically not encrypted at Layer 3 by default, whereas VPN Gateway uses IPsec encryption.

• ✗

  Azure Virtual Network

  Why it's wrong here

  Azure Virtual Network is the private, isolated network boundary in Azure that provides IP addressing, subnets, and network security controls for your resources. By itself, it does not establish encrypted tunnels or terminate VPN connections; rather, it is the environment into which a VPN Gateway is placed. A VNet acts as the address space and routing container, while VPN Gateway is the device that performs the encryption and internet-facing negotiation. Choosing only a VNet would leave you with no mechanism to reach on-premises securely.

• ✓

  Azure VPN Gateway

  Why this is correct

  Azure VPN Gateway is a virtual network gateway that sends encrypted traffic between an Azure virtual network and an on-premises location over the public internet. It supports IPsec/IKE site-to-site VPN tunnels, point-to-site OpenVPN/IKEv2/SSTP connections, and VNet-to-VNet tunnels. You deploy it into a dedicated GatewaySubnet and choose a route-based or policy-based gateway SKU, with the route-based type being the flexible, modern default. This is precisely the service that satisfies a requirement for encrypted hybrid connectivity across the internet.

• ✗

  Azure Bastion

  Why it's wrong here

  Azure Bastion is a fully managed platform service that provides secure, browser-based RDP and SSH access to virtual machines directly from the Azure portal without exposing public IP addresses on the VMs. It does not create an encrypted site-to-site link from an on-premises network; instead, it solves the problem of administrative remote access to individual VMs. Bastion requires a BastionSubnet and integrates with Azure Private Link, but it cannot forward traffic between on-premises and your entire Azure VNet. A hybrid connection scenario needs VPN Gateway, not a VM-access jump host.

Go deeper

Related to this question