AZ-900 Describe Azure architecture and services Practice Question
A company wants to connect their on-premises data center to Azure with a dedicated, private connection that does not traverse the internet. They also need to ensure high availability by having two active connections. Which Azure service and configuration should they use?
⚠ Common exam trap
Candidates often confuse 'active-active mode' on VPN Gateway with a dedicated private connection, not realizing that VPN Gateway still uses the internet, while ExpressRoute is the only service that offers a private, internet-free connection with dual-circuit high availability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute with two circuits.
Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet. To achieve high availability with two active connections, you must configure two ExpressRoute circuits, each connecting to different Microsoft Enterprise Edge (MSEE) devices, ensuring redundancy at the physical and network layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway with active-active mode.
Why it's wrong here
An Azure VPN Gateway in active-active mode creates two active tunnels between the gateway and on-premises VPN devices, providing IPsec redundancy and failover. However, the underlying transport is always the public internet, which introduces latency, jitter, and potential packet loss that a dedicated private path would avoid. Active-active mode improves availability but does not transform the internet-based VPN into a dedicated, private connection; that remains unique to ExpressRoute.
When this WOULD be correct
A company needs a site-to-site VPN connection between on-premises and Azure with high availability, but does not require a dedicated private link. The question would specify that using the internet is acceptable and cost is a primary concern.
- ✓
Azure ExpressRoute with two circuits.
Why this is correct
ExpressRoute is Microsoft's dedicated private connection between an on-premises data center and Azure, routed through a connectivity provider and bypassing the public internet entirely. Deploying two ExpressRoute circuits, ideally from different providers or peering locations, eliminates a single point of failure and satisfies enterprise high-availability requirements. This is the only option that meets both the 'dedicated' and 'two circuits' criteria in the scenario.
- ✗
Azure Virtual WAN with a single connection.
Why it's wrong here
Azure Virtual WAN is a networking service that aggregates branch connectivity into a hub, but it is not itself a dedicated connection. A single connection, whether a VPN tunnel or an ExpressRoute circuit, represents a single point of failure; Virtual WAN only provides redundancy when multiple underlying connections (such as two ExpressRoute circuits) are configured. Thus, one connection in Virtual WAN fails the stated requirement for both dedicated connectivity and high availability.
When this WOULD be correct
A company needs to connect multiple branch offices to Azure and manage network policies centrally, with high availability achieved through redundant VPN links within the Virtual WAN hub.
- ✗
Azure Point-to-Site VPN.
Why it's wrong here
Azure Point-to-Site VPN is designed for individual remote clients, such as telecommuters, to securely connect to an Azure virtual network from anywhere using SSTP, IKEv2, or OpenVPN. It does not support connecting an entire on-premises data center; that scenario requires Site-to-Site VPN or ExpressRoute. Additionally, it operates over the public internet, so it cannot provide a dedicated private connection.
When this WOULD be correct
An exam question where a company needs to securely connect remote employees or branch offices to Azure from individual client computers over the internet, without requiring a site-to-site or dedicated connection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure ExpressRoute with two circuits.Correct answer▾
Why this is correct
ExpressRoute is Microsoft's dedicated private connection between an on-premises data center and Azure, routed through a connectivity provider and bypassing the public internet entirely. Deploying two ExpressRoute circuits, ideally from different providers or peering locations, eliminates a single point of failure and satisfies enterprise high-availability requirements. This is the only option that meets both the 'dedicated' and 'two circuits' criteria in the scenario.
✗Azure VPN Gateway with active-active mode.Wrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway with active-active mode still uses the public internet for connectivity, not a dedicated private connection, so it does not meet the requirement to avoid traversing the internet.
★ When this WOULD be the correct answer
A company needs a site-to-site VPN connection between on-premises and Azure with high availability, but does not require a dedicated private link. The question would specify that using the internet is acceptable and cost is a primary concern.
Why candidates choose this
Candidates may confuse 'active-active' mode with providing high availability and mistakenly think it offers a private connection, overlooking that VPN Gateway always uses the internet.
✗Azure Virtual WAN with a single connection.Wrong answer — click to see why▾
Why this is wrong here
Azure Virtual WAN with a single connection does not provide a dedicated, private connection that bypasses the internet; it typically uses VPN or ExpressRoute but a single connection lacks the high availability of two active connections.
★ When this WOULD be the correct answer
A company needs to connect multiple branch offices to Azure and manage network policies centrally, with high availability achieved through redundant VPN links within the Virtual WAN hub.
Why candidates choose this
Candidates may confuse Virtual WAN's ability to aggregate connections as providing dedicated private connectivity, overlooking that it still relies on underlying VPN or ExpressRoute and a single connection does not meet the high availability requirement.
✗Azure Point-to-Site VPN.Wrong answer — click to see why▾
Why this is wrong here
Azure Point-to-Site VPN connects individual clients to Azure over the internet, not a dedicated private connection between data centers, and does not support high availability with two active connections.
★ When this WOULD be the correct answer
An exam question where a company needs to securely connect remote employees or branch offices to Azure from individual client computers over the internet, without requiring a site-to-site or dedicated connection.
Why candidates choose this
Candidates may confuse Point-to-Site VPN with Site-to-Site VPN, or think any VPN provides a private connection, overlooking the requirement for a dedicated, non-internet link and high availability.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure ExpressRoute
Azure ExpressRoute is a dedicated, private, and high-speed network connection from your on-premises data center to Microsoft's cloud, bypassing the public internet for better reliability, security, and performance.
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.