AZ-900 Describe Azure architecture and services Practice Question
A company runs a critical ERP system on-premises and plans to extend the application to Azure IaaS VMs for burst capacity. The network team requires a dedicated, private connection between the on-premises data center and Azure that does not traverse the public internet. The connection must offer consistent latency, high bandwidth options up to 10 Gbps, and a financially backed SLA for availability. Which Azure service should the team provision to meet these requirements?
⚠ Common exam trap
Microsoft often tests the misconception that a site-to-site VPN can provide dedicated, private connectivity with guaranteed performance, but the key differentiator is that ExpressRoute bypasses the public internet entirely and offers a financially backed SLA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring consistent latency and high bandwidth up to 10 Gbps. It also offers a financially backed SLA for availability, making it the ideal choice for extending a critical ERP system for burst capacity with predictable performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure ExpressRoute
Why this is correct
Correct. ExpressRoute provides a dedicated private circuit from an on-premises network to Azure, bypassing the public internet for improved latency, security, and reliability. It supports high bandwidth (up to 10 Gbps) and offers a financially backed SLA (e.g., 99.95% availability for a single connection).
- ✗
Azure VPN Gateway (site-to-site)
Why it's wrong here
Incorrect. A site-to-site VPN over the public internet does not provide a dedicated private path. It cannot guarantee consistent latency, offers lower maximum bandwidth (typically up to 1.25 Gbps), and has no SLA for throughput or latency.
When this WOULD be correct
A company needs to connect an on-premises network to Azure over the public internet with encrypted traffic, using standard IPsec/IKE protocols, and requires bandwidth up to 1.25 Gbps (or 10 Gbps with multiple tunnels) but does not need a private connection or latency guarantees.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global, cloud-native application delivery and load-balancing service that routes HTTP/HTTPS traffic over the public internet to optimize performance, TLS termination, and path-based routing for web applications. It is not a hybrid-connectivity service; it does not create any private or dedicated link between an on-premises network and Azure. Instead, it relies on internet-facing endpoints (such as Azure App Service or VMs behind a load balancer) and provides no SLA on latency or throughput for the underlying network path, making it irrelevant for private, high-bandwidth, low-latency ERP connectivity.
When this WOULD be correct
A company wants to improve the performance and availability of a global web application by providing intelligent routing, SSL offloading, and web application firewall capabilities. The solution must accelerate content delivery and provide global load balancing across multiple Azure regions.
- ✗
Azure Bastion
Why it's wrong here
Incorrect. Azure Bastion provides secure browser-based RDP and SSH access to Azure VMs from the Azure portal. It does not create a private connection between on-premises and Azure; it is a management service that operates within Azure.
When this WOULD be correct
A company needs to securely manage Azure VMs from the Azure portal without exposing public IP addresses. The team requires a fully managed PaaS service that provides RDP/SSH connectivity through the portal, with built-in DDoS protection and no need for a VPN or public endpoint.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure ExpressRouteCorrect answer▾
Why this is correct
Correct. ExpressRoute provides a dedicated private circuit from an on-premises network to Azure, bypassing the public internet for improved latency, security, and reliability. It supports high bandwidth (up to 10 Gbps) and offers a financially backed SLA (e.g., 99.95% availability for a single connection).
✗Azure VPN Gateway (site-to-site)Wrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway site-to-site connections traverse the public internet and do not offer a dedicated private connection, consistent latency, or a financially backed SLA for availability like ExpressRoute does.
★ When this WOULD be the correct answer
A company needs to connect an on-premises network to Azure over the public internet with encrypted traffic, using standard IPsec/IKE protocols, and requires bandwidth up to 1.25 Gbps (or 10 Gbps with multiple tunnels) but does not need a private connection or latency guarantees.
Why candidates choose this
Candidates may confuse site-to-site VPN with a private connection because both provide connectivity between on-premises and Azure, but they overlook the requirement for a dedicated, non-internet path and high-bandwidth SLA.
✗Azure Front DoorWrong answer — click to see why▾
Why this is wrong here
Azure Front Door is a global load balancer and application delivery controller that operates over the public internet, not a dedicated private connection. It does not provide a private, dedicated link with consistent latency and high bandwidth up to 10 Gbps with a financially backed SLA for availability.
★ When this WOULD be the correct answer
A company wants to improve the performance and availability of a global web application by providing intelligent routing, SSL offloading, and web application firewall capabilities. The solution must accelerate content delivery and provide global load balancing across multiple Azure regions.
Why candidates choose this
Candidates may confuse Front Door's global reach and performance features with the need for a private connection, or they may think it can replace ExpressRoute for hybrid connectivity due to its 'fastest' routing capabilities.
✗Azure BastionWrong answer — click to see why▾
Why this is wrong here
Azure Bastion provides secure RDP/SSH access to VMs over TLS within the same virtual network, not a dedicated private connection between on-premises and Azure. It does not offer high-bandwidth, low-latency connectivity or a financially backed SLA for inter-site links.
★ When this WOULD be the correct answer
A company needs to securely manage Azure VMs from the Azure portal without exposing public IP addresses. The team requires a fully managed PaaS service that provides RDP/SSH connectivity through the portal, with built-in DDoS protection and no need for a VPN or public endpoint.
Why candidates choose this
Candidates may confuse 'private connection' with 'secure access to VMs,' assuming Bastion's private connectivity to VMs satisfies the requirement for a dedicated link between on-premises and Azure.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
IaaS
IaaS stands for Infrastructure as a Service, which means renting virtual computing resources like servers, storage, and networking from a cloud provider instead of buying and managing physical hardware yourself.
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.