AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure ExpressRoute

  Why it's wrong here

  Azure ExpressRoute is a private, dedicated network connection from your on-premises infrastructure to Azure through a third-party connectivity provider. Unlike a VPN, it does not use IPsec-encrypted tunnels over the public internet, and traffic is not encrypted by default. Therefore, it fails the specific requirement of an encrypted site-to-site VPN tunnel, even though it provides hybrid connectivity with higher bandwidth and lower latency.

• ✓

  Azure VPN Gateway

  Why this is correct

  Azure VPN Gateway is the correct service because it is a virtual network gateway that sends encrypted traffic between an Azure virtual network and an on-premises location over the public internet using IPsec/IKE protocol. It supports site-to-site connections that create secure, encrypted tunnels, which exactly matches the requirement for secure on-premises-to-Azure hybrid connectivity via VPN. It also supports point-to-site and VNet-to-VNet connections, making it the appropriate choice for this scenario.

• ✗

  Azure Front Door

  Why it's wrong here

  Azure Front Door is a global, scalable entry point that provides content delivery network (CDN), application acceleration, and load balancing for HTTP/HTTPS web traffic. It operates at Layer 7 (application layer) and routes user requests to the fastest available backend, but it does not establish site-to-site IPsec VPN tunnels or provide raw encrypted connectivity between an on-premises network and Azure. As a result, it is not the correct service for this requirement.

• ✗

  Azure Firewall

  Why it's wrong here

  Azure Firewall is a managed, cloud-native network security service that filters and logs traffic between resources in Azure and the internet or between virtual networks. It provides high-availability and threat protection, but it is not a VPN gateway and does not terminate site-to-site VPN connections or create encrypted tunnels. Its role is to enforce security rules, not to establish secure hybrid connectivity, so it is the wrong answer for this scenario.