AZ-900 Describe Azure architecture and services Practice Question
Which Azure service allows you to create a private network connection between your Azure VNet and your on-premises network using a dedicated circuit, not over the public internet?
⚠ Common exam trap
It's easy for candidates to confuse Azure VPN Gateway (which also connects on-premises to Azure) with ExpressRoute, failing to recognize that VPN Gateway uses the public internet while ExpressRoute uses a dedicated private circuit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute is the correct answer because it provides a dedicated, private connection from your on-premises network to Azure, bypassing the public internet entirely. This is achieved through a direct, private circuit provided by a connectivity partner, offering higher reliability, lower latency, and higher bandwidth than internet-based connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes encrypted IPsec tunnels over the public internet, which contrasts with ExpressRoute's use of dedicated, non-internet-based circuits. While both provide hybrid connectivity, VPN Gateway is subject to internet latency and unpredictable packet loss, and it typically offers lower bandwidth and no SLA-backed reliability compared to ExpressRoute. The key differentiator is that VPN traffic traverses the public internet, whereas ExpressRoute bypasses it completely.
- ✓
Azure ExpressRoute
Why this is correct
Azure ExpressRoute creates a dedicated, private network connection between your on-premises infrastructure and Azure data centers, entirely bypassing the public internet. This reduces latency, improves security, and provides higher reliability and consistent SLA-backed performance compared to internet-based connections. It supports private peering, Microsoft peering, and even dedicated circuits via ExpressRoute Direct.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a cloud-based networking service that aggregates branch connectivity through a hub-and-spoke model, supporting site-to-site VPN, remote user VPN, and ExpressRoute connectivity, but it is not itself a dedicated private circuit. It enables SD-WAN integration and routing policies, yet it depends on underlying transport (like ExpressRoute or VPN) for the actual physical connection. Selecting Virtual WAN as the answer would confuse an orchestration/management layer with the direct, private link that ExpressRoute provides.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed PaaS service that provides secure browser-based RDP and SSH access to virtual machines over the public endpoint, using TLS to protect administrative sessions. Its purpose is to eliminate exposing VMs to public IPs, not to connect on-premises networks to Azure for data-plane traffic. Since the scenario calls for hybrid network connectivity between a corporate datacenter and Azure, Bastion does not address that requirement at all.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure ExpressRoute
Azure ExpressRoute is a dedicated, private, and high-speed network connection from your on-premises data center to Microsoft's cloud, bypassing the public internet for better reliability, security, and performance.
Key term
Reliability
Reliability is the measure of a system's ability to consistently perform its intended functions without failure over a specified period of time under stated conditions.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.