AZ-900 Describe Azure architecture and services Practice Question
What is the primary purpose of Azure Virtual Network (VNet)?
⚠ Common exam trap
Many candidates confuse VNet with a global load balancer or a security service, but VNet is fundamentally a private network container for Azure resources, not a traffic distribution or identity management tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide a private, isolated network for Azure resources
Azure Virtual Network (VNet) enables Azure resources, such as VMs and App Services, to securely communicate with each other, the internet, and on-premises networks. It provides network isolation and segmentation, allowing you to define private IP address spaces, subnets, and routing rules. This makes B the correct answer because the primary purpose of a VNet is to create a private, isolated network environment in the cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To provide identity and access management for Azure resources
Why it's wrong here
Identity and access management (IAM) is a separate service layer provided by Microsoft Entra ID (previously Azure AD) and Azure RBAC, not by Virtual Network. VNet is a Layer 3 networking construct that handles IP traffic isolation and routing, whereas authentication and authorization are policy-based controls managed at the identity plane. While network security groups within a VNet can filter traffic, they do not authenticate users or assign permissions to cloud resources.
- ✓
To provide a private, isolated network for Azure resources
Why this is correct
Azure Virtual Network (VNet) creates a logically isolated segment in the Azure cloud, giving you control over IP address ranges, subnets, route tables, and network security groups. This isolation ensures resources like VMs and App Services can communicate privately within the VNet and securely connect to on-premises networks via VPN or ExpressRoute. Unlike public internet exposure, VNet provides a trusted boundary for your workloads, which is its core purpose.
- ✗
To distribute traffic across multiple Azure regions
Why it's wrong here
Distributing traffic across multiple Azure regions is accomplished by global load balancers like Azure Traffic Manager or Azure Front Door, which use DNS-based routing to steer users to the closest or healthiest regional endpoint. A Virtual Network is region-scoped; it spans only a single region (or availability zones within that region) and cannot natively route traffic between regions. VNet peering can connect two VNets, but that still requires separate VNet deployments and does not perform regional traffic distribution.
- ✗
To store and manage encryption keys
Why it's wrong here
Storing and managing encryption keys is the function of Azure Key Vault, a dedicated secrets management service that provides HSMs and FIPS-validated key storage. Virtual Network has no cryptographic capabilities; it simply provides IP-level connectivity and network isolation. Key management involves key lifecycle, rotation, and access policies, all outside the networking layer's scope.
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.