AZ-900 Describe Azure architecture and services Practice Question
Which Azure networking service enables you to create a hub-and-spoke network topology where multiple VNets are connected and can communicate through a central hub VNet?
⚠ Common exam trap
Candidates often confuse VNet Peering with VPN Gateway, assuming that a VPN connection is required to link VNets, but VNet Peering is the native, higher-performance, and lower-latency solution for connecting VNets within Azure without internet-based encryption overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure VNet Peering
Azure VNet Peering is the correct service because it directly connects two or more Azure Virtual Networks (VNets) using the Microsoft backbone infrastructure, enabling a hub-and-spoke topology where multiple spoke VNets communicate through a central hub VNet. Unlike VPN-based solutions, VNet Peering provides low-latency, private connectivity without traversing the public internet, and it supports transitive routing only when explicitly configured via a network virtual appliance (NVA) or Azure Route Server in the hub.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway is designed for establishing secure, encrypted connections, typically between an Azure VNet and an on-premises network (site-to-site), or for individual client access (point-to-site). While it can connect Azure VNets to each other, it is not the native, high-performance service intended for creating a hub-and-spoke topology entirely within Azure's backbone for VNet-to-VNet communication. It would be the correct choice for hybrid connectivity or secure remote access to an Azure VNet.
- ✓
Azure VNet Peering
Why this is correct
Azure VNet Peering connects two Azure virtual networks through Microsoft's high-speed backbone network, allowing resources in different VNets to communicate privately as if they were in the same network. It supports hub-and-spoke architectures by enabling low-latency, high-bandwidth, transitive routing between peered VNets without requiring a gateway or traversing the public internet. This makes it the native, correct service for VNet-to-VNet connectivity within Azure.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at Layer 4 (transport) and distributes inbound traffic to a pool of backend resources, such as virtual machines or instances, for high availability and scalability. It works entirely within a single virtual network or across availability zones, but it has no capability to route or bridge traffic between separate VNets. Because it never creates a network path between VNets, it cannot serve as the connectivity mechanism for a hub-and-spoke topology.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a Layer 7 global load balancer and application delivery controller that routes HTTP/HTTPS traffic to the fastest and healthiest backend endpoints, optimizing web application performance at the global edge. It operates at the application layer and does not establish a Layer 3 network path between virtual networks, so it cannot be used for private VNet-to-VNet routing or to build a hub-and-spoke network topology. Its purpose is content delivery and web traffic acceleration, not network-level VNet connectivity.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual appliance
A virtual appliance is a pre-built software solution that includes an operating system and application, packaged as a virtual machine image for easy deployment on a hypervisor.
Key term
VNet peering
VNet peering is a networking connection that links two virtual networks so they can communicate with each other as if they were a single network.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.