AZ-900 Describe Azure architecture and services Practice Question
Which Azure networking service acts as a software-defined WAN that connects branch offices, datacenters, and remote users through an optimized global network?
⚠ Common exam trap
Candidates often confuse Azure VPN Gateway with Virtual WAN because both support VPN connectivity, but Virtual WAN is a full SD-WAN solution that aggregates multiple connection types and optimizes global routing, whereas VPN Gateway is a single-site VPN endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Virtual WAN
Azure Virtual WAN is a software-defined WAN (SD-WAN) service that provides a unified, optimized global network connecting branch offices, datacenters, and remote users. It leverages Microsoft's global backbone to route traffic efficiently, automatically selecting the best path and reducing latency, while integrating with VPN, ExpressRoute, and SD-WAN partners for seamless connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway creates encrypted IPsec/IKE tunnels between an Azure virtual network and on-premises locations or other VNets, using either site-to-site or point-to-site connections. Its scope is limited to acting as a VPN endpoint for a single virtual network or with VNet peering; it alone cannot form the multi-region, hub-spoke mesh that Virtual WAN provides. Branch traffic would still traverse the public internet and require separate gateways, so VPN Gateway is only a component within a broader WAN solution rather than the full SD-WAN service.
- ✓
Azure Virtual WAN
Why this is correct
Azure Virtual WAN is a managed networking service that builds a global hub-and-spoke architecture, connecting branch offices, data centers, and remote users through Microsoft's backbone rather than the public internet. It integrates SD-WAN, site-to-site VPN, ExpressRoute, and dynamic routing into a single control plane, automatically optimizing network paths and minimizing costs. Because it provides an any-to-any transit network across regions, it is the service purpose-built for WAN-scale branch connectivity.
- ✗
Azure ExpressRoute
Why it's wrong here
Azure ExpressRoute delivers private, dedicated connectivity between on-premises infrastructure and Azure, bypassing the public internet to provide higher reliability and lower latency. However, it is fundamentally a point-to-point circuit from a specific location to an Azure region; it does not dynamically route traffic among multiple branches or provide SD-WAN-style optimization. Supporting many sites would require multiple ExpressRoute circuits plus separate routing devices, making it incorrect as a managed WAN connectivity service for branch environments.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer is a layer 4 load balancer that distributes incoming TCP or UDP traffic among healthy virtual machines within a single Azure region, primarily for application availability. It has no role in connecting branches, data centers, or remote users, and it cannot route traffic across a wide-area network. Because it operates at the data-center edge rather than the WAN edge, it is entirely unsuited to the described requirement of optimizing branch connectivity.
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.