Azure VNet Peering: Cross-Region Private IP Connectivity
A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Both virtual networks use non-overlapping IP address spaces and are deployed in different resource groups. The company needs to enable communication between resources in VNet-A and VNet-B using private IP addresses only, with low latency and without any traffic traversing the public internet. The solution must not require deploying a virtual network gateway or any additional network appliance. Which Azure service should the company use?
Quick Answer
The answer is Azure Virtual Network Peering. This service directly connects VNet-A and VNet-B over the Microsoft backbone network, enabling cross-region private IP communication with low latency and no traffic traversing the public internet. Because both virtual networks use non-overlapping IP address spaces, global VNet peering works seamlessly without requiring a virtual network gateway or any additional network appliance. On the AZ-900 exam, this scenario tests your understanding of how Azure provides native, secure connectivity between resources across regions—a common trap is assuming you need a VPN gateway or ExpressRoute for cross-region links, but VNet peering handles this natively. Remember that global peering supports any Azure region, and the key requirement is simply non-overlapping address spaces. For a quick memory tip: think “peer across regions, no gateway needed”—if the question mentions private IPs, low latency, and no public internet, VNet peering is almost always the answer.
⚠ Common exam trap
Watch out — candidates often confuse VPN Gateway with VNet Peering, assuming a gateway is required for any cross-region connectivity, but Azure Global VNet Peering provides direct private connectivity without gateways or public internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Virtual Network Peering
Azure Virtual Network Peering connects VNet-A and VNet-B directly over the Microsoft backbone network, enabling private IP communication with low latency and no public internet traversal. It requires no virtual network gateway or additional appliances, and works across regions (global peering) as long as IP address spaces are non-overlapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
A VPN gateway creates encrypted tunnels over the internet between VNets, but it requires deploying a gateway subnet, incurs additional cost, and adds latency. The question explicitly states no gateway is to be deployed, making this option incorrect.
When this WOULD be correct
Azure VPN Gateway would be correct if the question required connecting on-premises networks to Azure VNets over the internet with encrypted tunnels, or connecting VNets across different Azure regions when VNet peering is not supported (e.g., overlapping IP addresses) and a gateway is allowed.
- ✓
Azure Virtual Network Peering
Why this is correct
Virtual Network Peering connects two VNets privately over Microsoft's backbone network. It supports cross-region (global) peering, uses private IP addresses, does not require a gateway, and provides low-latency, high-throughput connectivity. This exactly meets all stated requirements.
- ✗
Azure ExpressRoute
Why it's wrong here
ExpressRoute provides dedicated private connectivity from on-premises networks to Azure. It does not directly connect one VNet to another VNet. Additionally, it requires a gateway and an ExpressRoute circuit, which violates the no-gateway requirement.
When this WOULD be correct
A company needs to connect an on-premises data center to Azure virtual networks with guaranteed bandwidth, low latency, and private connectivity that bypasses the public internet. ExpressRoute would be the correct choice when the requirement is hybrid connectivity, not VNet-to-VNet.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer distributes incoming traffic across resources inside the same virtual network or across peered VNets, but it does not establish connectivity between VNets. It is a traffic distribution service, not a connectivity service, and cannot be used to link VNet-A and VNet-B.
When this WOULD be correct
A company has a web application deployed on multiple virtual machines in the same virtual network across different availability zones. They need to distribute incoming internet traffic evenly across these VMs for high availability. Azure Load Balancer would be the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Virtual Network PeeringCorrect answer▾
Why this is correct
Virtual Network Peering connects two VNets privately over Microsoft's backbone network. It supports cross-region (global) peering, uses private IP addresses, does not require a gateway, and provides low-latency, high-throughput connectivity. This exactly meets all stated requirements.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway requires traffic to traverse the public internet (even if encrypted) and introduces higher latency, contradicting the requirement for private IP-only communication without public internet traversal. Additionally, it mandates deploying a gateway, which the question explicitly excludes.
★ When this WOULD be the correct answer
Azure VPN Gateway would be correct if the question required connecting on-premises networks to Azure VNets over the internet with encrypted tunnels, or connecting VNets across different Azure regions when VNet peering is not supported (e.g., overlapping IP addresses) and a gateway is allowed.
Why candidates choose this
Candidates may confuse VPN Gateway with a solution for private connectivity, not realizing that VPN Gateway still uses the public internet and requires a gateway deployment, whereas VNet peering provides direct private connectivity without such components.
✗Azure ExpressRouteWrong answer — click to see why▾
Why this is wrong here
Azure ExpressRoute requires a dedicated private connection to an on-premises network or a colocation provider, not for connecting two Azure virtual networks. It also involves higher cost and complexity, and does not meet the requirement of no additional gateway or appliance.
★ When this WOULD be the correct answer
A company needs to connect an on-premises data center to Azure virtual networks with guaranteed bandwidth, low latency, and private connectivity that bypasses the public internet. ExpressRoute would be the correct choice when the requirement is hybrid connectivity, not VNet-to-VNet.
Why candidates choose this
Candidates may think ExpressRoute provides private connectivity and low latency, and mistakenly assume it can be used for VNet peering scenarios, overlooking that it is designed for on-premises connections, not direct VNet-to-VNet.
✗Azure Load BalancerWrong answer — click to see why▾
Why this is wrong here
Azure Load Balancer distributes incoming traffic across multiple resources but does not enable private IP connectivity between two separate virtual networks in different regions. It operates within a single virtual network or across availability zones, not between peered networks.
★ When this WOULD be the correct answer
A company has a web application deployed on multiple virtual machines in the same virtual network across different availability zones. They need to distribute incoming internet traffic evenly across these VMs for high availability. Azure Load Balancer would be the correct choice.
Why candidates choose this
Candidates may mistakenly think Load Balancer can connect networks because it handles traffic distribution, but it lacks the routing capabilities needed for inter-network private connectivity.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Each VNet hosts a set of virtual machines that run a distributed application. The application requires private, low-latency communication between the VMs in VNet-A and VNet-B. The company wants to minimize operational complexity and avoid any additional billing for data transfer between the two VNets beyond the standard Azure data transfer charges. Which Azure service should the company use to connect the two virtual networks?
medium- ✓ A.Azure Virtual Network Peering
- B.Azure VPN Gateway (Site-to-Site)
- C.Azure ExpressRoute
- D.Azure Front Door
Why A: Azure Virtual Network Peering is the correct choice because it connects two virtual networks directly over the Microsoft backbone network, providing private, low-latency communication between VMs in different regions. It incurs only standard Azure data transfer charges (no additional gateway or circuit costs) and requires minimal operational overhead, as it is a simple configuration with no extra devices or bandwidth provisioning.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.