AZ-900 Describe Azure architecture and services Practice Question
A company needs to connect their on-premises network to Azure with a dedicated, private, and high-bandwidth connection that does not traverse the public internet. They require an SLA for availability and performance. Which Azure service should they use?
⚠ Common exam trap
It's easy for candidates to confuse Azure VPN Gateway's 'private tunnel' (which is still over the public internet) with a truly private connection, or they assume Azure Virtual WAN alone provides dedicated bandwidth, when in fact it is an orchestration service that requires ExpressRoute for non-internet connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from on-premises networks to Azure that does not traverse the public internet. It offers a Service-Level Agreement (SLA) for availability (e.g., 99.95% for a single connection with redundancy) and performance, which is not guaranteed over internet-based VPNs. This meets the requirement for high bandwidth, privacy, and a guaranteed SLA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes encrypted Site-to-Site IPsec tunnels that carry traffic over the public internet. While the data is protected in transit, the underlying network is shared, and performance, latency, and reliability depend on internet conditions with no dedicated bandwidth or ExpressRoute-level SLA, so it does not meet the requirement for a dedicated private connection.
When this WOULD be correct
A company needs to connect their on-premises network to Azure over the public internet with encrypted traffic, and they require a cost-effective solution for moderate bandwidth needs without a dedicated private connection.
- ✓
Azure ExpressRoute
Why this is correct
Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure data centers, established through a connectivity provider at layer 3. Because traffic never traverses the public internet, it offers higher reliability, lower latency, and an SLA-backed 99.95% availability, making it the only option that satisfies a requirement for a dedicated private link.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a hub-and-spoke networking service that aggregates connectivity from branch locations and can integrate ExpressRoute, Site-to-Site VPN, or Remote User VPN connections into a unified topology. It is an orchestration and routing fabric, not a physical or dedicated link itself; the actual private connection would still be an ExpressRoute circuit, so Virtual WAN alone cannot provide the dedicated line described.
When this WOULD be correct
A company with multiple branch offices needs to connect them to Azure and to each other with automated routing and optimization, while optionally using ExpressRoute or VPN for connectivity. The question would ask for a service that simplifies hub-and-spoke networking for branch offices.
- ✗
Azure Peering Service
Why it's wrong here
Azure Peering Service is designed to improve the reliability and performance of internet routing to Microsoft cloud services by partnering with internet service providers. It does not provision a private circuit; rather, it optimizes traffic that still flows over the public internet, so it fails the requirement for a dedicated private connection with guaranteed bandwidth and isolation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure ExpressRouteCorrect answer▾
Why this is correct
Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure data centers, established through a connectivity provider at layer 3. Because traffic never traverses the public internet, it offers higher reliability, lower latency, and an SLA-backed 99.95% availability, making it the only option that satisfies a requirement for a dedicated private link.
✗Azure VPN GatewayWrong answer — click to see why▾
Why this is wrong here
Azure VPN Gateway uses the public internet and does not provide a dedicated, private connection with an availability SLA for performance, unlike ExpressRoute which offers a private, high-bandwidth connection with an SLA.
★ When this WOULD be the correct answer
A company needs to connect their on-premises network to Azure over the public internet with encrypted traffic, and they require a cost-effective solution for moderate bandwidth needs without a dedicated private connection.
Why candidates choose this
Candidates may confuse VPN Gateway with a private connection because it also provides secure connectivity, but they overlook that it uses the public internet and lacks the dedicated, SLA-backed performance of ExpressRoute.
✗Azure Virtual WANWrong answer — click to see why▾
Why this is wrong here
Azure Virtual WAN is a networking service that provides optimized and automated branch-to-branch connectivity, but it does not offer a dedicated private connection with an availability SLA like ExpressRoute. It typically uses VPN or ExpressRoute as underlying transport, so it is not the direct answer for a dedicated private connection.
★ When this WOULD be the correct answer
A company with multiple branch offices needs to connect them to Azure and to each other with automated routing and optimization, while optionally using ExpressRoute or VPN for connectivity. The question would ask for a service that simplifies hub-and-spoke networking for branch offices.
Why candidates choose this
Candidates may confuse Virtual WAN as a replacement for ExpressRoute because it can integrate with ExpressRoute circuits, but they overlook that Virtual WAN is a higher-level orchestration service, not the dedicated private connection itself.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure ExpressRoute
Azure ExpressRoute is a dedicated, private, and high-speed network connection from your on-premises data center to Microsoft's cloud, bypassing the public internet for better reliability, security, and performance.
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.