AZ-802 Practice Question: Implement and Manage On-Prem and Hybrid Networking
You are managing a hybrid cloud environment and need to connect an on-premises Windows Server 2022 to an Azure Virtual Network. Which service should you implement to provide a secure, persistent, and encrypted tunnel over the public internet?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Site-to-Site VPN
A Site-to-Site VPN is the standard solution for connecting on-premises infrastructure to Azure over the internet using an IPsec/IKE tunnel. It provides a secure, encrypted path for traffic, ensuring that data moving between the local data center and the cloud remains protected. This is the most common deployment scenario for hybrid connectivity where a dedicated line like ExpressRoute is not financially feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure ExpressRoute
Why it's wrong here
ExpressRoute provides a private, dedicated connection to Azure that does not traverse the public internet. It is a high-performance solution, but it is not a VPN tunnel and does not use standard public internet encryption in the same way a Site-to-Site VPN does for smaller scale requirements.
- ✓
Azure Site-to-Site VPN
Why this is correct
This service creates an IPsec/IKE VPN tunnel between your on-premises VPN gateway and an Azure Virtual Network gateway. It is designed specifically for persistent, secure connectivity over the public internet, making it the ideal choice for hybrid networking when a private fiber connection is not required or available.
- ✗
Remote Access Server (RAS) Gateway
Why it's wrong here
While a RAS Gateway is a Windows role that can host VPN connections, it is an on-premises component. It does not natively provide the cloud-side gateway functionality required to interface with Azure's Virtual Network infrastructure without additional configuration and an Azure-side gateway service to terminate the tunnel connection.
- ✗
Azure Point-to-Site VPN
Why it's wrong here
Point-to-Site VPN is intended for individual clients or devices connecting to an Azure Virtual Network, rather than connecting an entire local data center subnet. Scaling this to support a persistent, site-wide hybrid connection is inefficient and does not meet the requirements for enterprise-grade site-to-site network integration.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
This AZ-802 question is part of Courseiva's 116-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.