AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure VNet Peering

  Why it's wrong here

  Azure VNet Peering links two virtual networks directly over the Microsoft backbone, but it is a point-to-point connection that requires you to establish peering between every pair of VNets you wish to interconnect. It does not provide centralized management, built-in branch-to-VNet connectivity, or automatically create a hub-and-spoke topology, so it cannot replace the orchestration and scale of Azure Virtual WAN for a large multi-site environment. While VNet Peering is a building block that Virtual WAN itself uses, it lacks the integrated routing, security policies, and branch connectivity that define Virtual WAN.

• ✓

  Azure Virtual WAN

  Why this is correct

  Azure Virtual WAN is a managed cloud networking service that acts as a central hub, providing transitive routing, connectivity, and security across many VNets, branch sites, and on-premises networks in a hub-and-spoke topology. It natively integrates with VPN, ExpressRoute, and point-to-site connections, offering built-in routing tables, encrypted traffic, and optional Firewall or NVAs for consistent policy enforcement. This makes it the correct choice when the architecture requires a scalable, centrally managed hub to interconnect multiple VNets and on-premises locations — exactly the scenario described in the question.

• ✗

  Azure ExpressRoute

  Why it's wrong here

  Azure ExpressRoute creates a dedicated private connection from your on-premises network to Azure, bypassing the public internet for low latency and higher reliability. However, it only establishes a single link between your data center and Azure’s edge — it does not by itself route traffic among many VNets or automatically aggregate multiple branch connections into a managed hub. ExpressRoute can be used as one of the connections into Azure Virtual WAN, but without Virtual WAN you would still need to manually configure the routing and interconnectivity between VNets and other branches, making it an incomplete solution for a full hub-and-spoke network.

• ✗

  Azure Private Link

  Why it's wrong here

  Azure Private Link enables private connectivity to PaaS services (such as Storage or SQL) through private IP addresses in your virtual network, essentially pulling a service endpoint into your VNet. It is not designed to connect multiple VNets to each other or to link on-premises branch offices; its whole purpose is providing controlled, private access to specific managed services. Thus, Private Link would not address the requirement of interconnecting VNets and on-premises networks with a centralized hub — that is the role of Azure Virtual WAN.

Go deeper

Related to this question