AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a hybrid connection solution for enabling applications to access on-premises resources without inbound firewall changes?
⚠ Common exam trap
Candidates often confuse Azure Hybrid Connections with Azure VPN Gateway or ExpressRoute, assuming any hybrid solution requires inbound firewall changes, but Hybrid Connections uniquely uses an outbound-only relay over standard HTTPS ports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Hybrid Connections
Azure Hybrid Connections (part of Azure App Service and Azure Relay) allows applications to securely connect to on-premises resources over port 443 using WebSockets and TLS, without requiring any inbound firewall rules or changes to the on-premises network. This is achieved by establishing an outbound-only tunnel from the on-premises Hybrid Connection Manager to Azure, which then relays traffic to the target resource.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway builds an IPsec/IKE site-to-site or point-to-site tunnel over the public internet, encrypting all traffic between an on-premises network and an Azure VNet. It requires a VPN device on-premises, a public IP, and configuration of network rules and subnets, and it operates at the network layer. For an application-level connection that uses only outbound ports, VPN Gateway would be far more complex and would still require inbound firewall rules for VPN negotiation, unlike Hybrid Connections.
- ✓
Azure Hybrid Connections
Why this is correct
Azure Hybrid Connections, a feature of Azure Relay, lets an Azure App Service securely reach an on-premises resource through an outbound WebSocket connection, avoiding any inbound firewall changes. The on-premises Hybrid Connection Manager (HCM) initiates the connection to the Relay namespace, and the Azure app sends requests via that relay. This works at the application layer and is ideal for connecting to legacy or on-premises systems without exposing them to the public internet.
- ✗
Azure Private Link
Why it's wrong here
Azure Private Link provides private connectivity from a VNet to Azure PaaS services via private endpoints, so traffic stays entirely within the Azure backbone. It is the wrong tool here because it is designed to access Azure services privately, not to let an Azure App Service communicate with an on-premises resource. The on-premises component would still need a network-level tunnel or a public endpoint, so it does not satisfy the requirement of an application-level, outbound-only relay.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute establishes a dedicated, private Layer 3 circuit between an on-premises network and Azure, with high bandwidth and low latency. Configuring it requires BGP peering, router ARP, and often a service provider, and it connects entire networks rather than individual applications. It does not provide the per-application, outbound-relay model of Hybrid Connections, and it would be excessive and expensive for a simple app-to-on-premises scenario.
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.