AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Virtual Network Peering

  Why this is correct

  Azure Virtual Network Peering is the correct service because it enables direct, private connectivity between VNet A and VNet B regardless of their Azure regions, including East US and any other region, through Microsoft's backbone network. Global VNet peering uses private IP addresses without needing a gateway, VPN, or public internet, resulting in low-latency and high-bandwidth data transfer at standard networking costs. This approach is operationally simple, requiring only a peering relationship in each VNet, and avoids the added expense and routing complexity of alternate connectivity services.

• ✗

  Azure VPN Gateway (Site-to-Site)

  Why it's wrong here

  Azure VPN Gateway (Site-to-Site) is incorrect as it is primarily designed for establishing secure, encrypted connections between an Azure virtual network and an on-premises location over the public internet. While a VPN Gateway can connect two Azure VNets, this typically introduces higher latency and operational overhead compared to native Azure solutions for intra-Azure connectivity. This option would be the correct choice if the company needed to securely extend their on-premises network to Azure, or to connect two Azure virtual networks where encryption over a non-private backbone was a primary requirement.

  When this WOULD be correct

  A company needs to connect an on-premises network to an Azure VNet over the internet with encrypted traffic, requiring a site-to-site VPN for secure hybrid connectivity.

• ✗

  Azure ExpressRoute

  Why it's wrong here

  Azure ExpressRoute is incorrect because it is designed to provide dedicated, private, and resilient connections between an on-premises environment and Azure via a connectivity provider, not to connect two Azure virtual networks directly. To use ExpressRoute for this scenario, you would need multiple circuits and complex routing (e.g., a transit VNet or virtual appliance) to relay traffic between VNets, which introduces significant cost and administrative overhead. In contrast, VNet peering offers a native, low-latency, private path between Azure VNets without any gateway or external provider involvement.

  When this WOULD be correct

  A company needs to connect an on-premises data center to Azure VNets with guaranteed bandwidth, low latency, and a private connection that bypasses the public internet. The question would specify requirements for a service-level agreement (SLA) on availability and throughput, and the company is willing to pay for a dedicated circuit.

• ✗

  Azure Front Door

  Why it's wrong here

  Azure Front Door is incorrect because it is a global, cloud-native application delivery and load-balancing service that operates at Layer 7 (HTTP/HTTPS), optimizing traffic for web applications and APIs. It cannot establish a private network path between two virtual networks; it routes external client requests to the most appropriate backend, rather than forwarding raw IP packets between VNets. While Front Door can expose your services, it does not replace the need for VNet-level interconnectivity and does not support private peering or gateway-less communication between Azure virtual networks.

  When this WOULD be correct

  A company wants to provide global, low-latency access to a web application hosted in multiple Azure regions, with features like SSL offloading, path-based routing, and web application firewall. The requirement is for public-facing HTTP/HTTPS traffic, not private VNet-to-VNet connectivity.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question