AZ-900 Describe Azure architecture and services Practice Question
A company wants to connect an on-premises network to Azure with a dedicated private connection that bypasses the internet. Which service should they use?
⚠ Common exam trap
Watch out — candidates often confuse Azure VPN Gateway (which also connects on-premises to Azure) with a private connection, but VPN Gateway still uses the public internet as the underlying transport, whereas ExpressRoute is the only option that completely bypasses the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute is the correct service because it provides a dedicated, private connection from an on-premises network directly into Azure, bypassing the public internet entirely. This ensures lower latency, higher reliability, and greater security compared to internet-based connections, and it supports higher bandwidth options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway creates encrypted tunnels (IPsec/IKE) over the public internet to connect on-premises networks to Azure via a site-to-site VPN, or individual devices via point-to-site VPN. Although it provides private connectivity in the sense of encrypted traffic, the underlying transport still uses the public internet and therefore suffers from variable latency, potential ISP outages, and bandwidth constraints. It is not a dedicated private connection because it shares the internet's routing and does not offer a physical or logical private path.
When this WOULD be correct
When a company needs a secure, encrypted connection over the internet between an on-premises network and Azure, such as for a site-to-site VPN or point-to-site VPN, Azure VPN Gateway is the correct service.
- ✓
Azure ExpressRoute
Why this is correct
Azure ExpressRoute establishes a dedicated, private network connection between an on-premises infrastructure and Microsoft datacenters, provisioned through a connectivity provider (such as a carrier or exchange provider). Because it uses private peering and does not traverse the public internet, it offers higher reliability, lower latency, and stronger security guarantees than VPN-based connectivity. This makes it the only option in the list that meets the requirement of a dedicated private connection.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a networking orchestration service that aggregates various connectivity solutions, such as branch-to-branch, VPN, and ExpressRoute, into a single hub-and-spoke architecture. It is designed to simplify management and provide a unified global network, but it does not itself provide a dedicated private circuit. Instead, it relies on underlying components like VPN Gateway or ExpressRoute to supply the actual connectivity, so selecting Virtual WAN alone does not deliver a dedicated private connection.
When this WOULD be correct
A company wants to create a unified global network connecting multiple branch offices and Azure regions with automated routing and management. In that scenario, Azure Virtual WAN would be the correct answer because it simplifies large-scale networking by integrating VPN, ExpressRoute, and SD-WAN connectivity.
- ✗
Azure DNS
Why it's wrong here
Azure DNS is a global, highly available domain name resolution service that hosts DNS records and translates human-readable domain names into IP addresses. It is a control-plane or management service for naming, not a data-plane connectivity service, and it provides no capability to extend an on-premises network into Azure. Therefore, while DNS is essential for resolving endpoints, it has no role in establishing a dedicated private link between networks.
When this WOULD be correct
A question asking which Azure service resolves domain names to IP addresses, or which service provides DNS hosting for custom domains, would make Azure DNS the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure ExpressRouteCorrect answer▾
Why this is correct
Azure ExpressRoute establishes a dedicated, private network connection between an on-premises infrastructure and Microsoft datacenters, provisioned through a connectivity provider (such as a carrier or exchange provider). Because it uses private peering and does not traverse the public internet, it offers higher reliability, lower latency, and stronger security guarantees than VPN-based connectivity. This makes it the only option in the list that meets the requirement of a dedicated private connection.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway uses the public internet to create encrypted tunnels, not a dedicated private connection that bypasses the internet.
★ When this WOULD be the correct answer
When a company needs a secure, encrypted connection over the internet between an on-premises network and Azure, such as for a site-to-site VPN or point-to-site VPN, Azure VPN Gateway is the correct service.
Why candidates choose this
Candidates may confuse VPN Gateway with a private connection because both provide secure connectivity, but VPN Gateway relies on the internet rather than a dedicated private link.
✗Azure Virtual WANWrong answer — click to see why▾
Why this is wrong here
Azure Virtual WAN is a networking service that provides optimized and automated branch-to-branch and branch-to-Azure connectivity, but it does not inherently provide a dedicated private connection that bypasses the internet; it typically uses VPN or ExpressRoute as underlying connections.
★ When this WOULD be the correct answer
A company wants to create a unified global network connecting multiple branch offices and Azure regions with automated routing and management. In that scenario, Azure Virtual WAN would be the correct answer because it simplifies large-scale networking by integrating VPN, ExpressRoute, and SD-WAN connectivity.
Why candidates choose this
Candidates may confuse Virtual WAN with a direct private connection because it offers advanced networking capabilities, but they overlook that it relies on other services like ExpressRoute for dedicated private links.
✗Azure DNSWrong answer — click to see why▾
Why this is wrong here
Azure DNS is a domain name resolution service, not a connectivity service. It does not provide private, dedicated connections between on-premises networks and Azure.
★ When this WOULD be the correct answer
A question asking which Azure service resolves domain names to IP addresses, or which service provides DNS hosting for custom domains, would make Azure DNS the correct answer.
Why candidates choose this
Candidates may confuse DNS with network connectivity services because DNS is essential for network communication, leading them to incorrectly associate it with private connections.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Azure ExpressRoute
Azure ExpressRoute is a dedicated, private, and high-speed network connection from your on-premises data center to Microsoft's cloud, bypassing the public internet for better reliability, security, and performance.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.