MS-900 Describe cloud concepts Practice Question
A company needs a dedicated, private network connection between its on-premises data center and Microsoft's cloud infrastructure to support a hybrid deployment with low latency and high reliability. The connection must not traverse the public internet. Which service should they use?
⚠ Common exam trap
Candidates often confuse Azure VPN Gateway with a private connection because it uses encryption, but the key differentiator is that VPN traffic still traverses the public internet, whereas ExpressRoute bypasses it entirely for a truly private, dedicated link.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure ExpressRoute
Azure ExpressRoute is the correct choice because it provides a dedicated, private network connection from an on-premises data center directly into Microsoft's cloud infrastructure, bypassing the public internet entirely. This ensures low latency, high reliability, and consistent performance for hybrid deployments, as the traffic traverses a private MPLS or Ethernet link rather than the unpredictable internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure ExpressRoute
Why this is correct
Azure ExpressRoute provisions a dedicated, private Layer 2 or Layer 3 circuit through an MPLS or network service provider, extending an on-premises infrastructure directly into Azure at Microsoft edge locations without traversing the public internet. This private connectivity offers lower and more consistent latency, higher security, bandwidth up to 100 Gbps, and a 99.95% availability SLA when redundant circuits are configured. For a company that specifically requires a dedicated private network connection for hybrid workloads, ExpressRoute is the Azure service built exactly for that scenario.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway creates site-to-site IPsec tunnels over the public internet, so traffic is encrypted but still travels across shared, internet-routed infrastructure where latency, jitter, and congestion can vary unpredictably. It does not deliver a dedicated or private physical link between the customer's network and Azure, and its bandwidth limits are typically lower than ExpressRoute's. Therefore, although VPN Gateway is a valid hybrid connectivity solution, it does not meet the 'dedicated private network connection' requirement that ExpressRoute satisfies.
- ✗
Azure Virtual WAN
Why it's wrong here
Azure Virtual WAN is a networking service that unifies branch connectivity, but it is not a direct private connection itself. ExpressRoute can be used as part of Virtual WAN but the question asks for the specific service that provides the private link.
- ✗
Microsoft Entra ID Application Proxy
Why it's wrong here
Application Proxy allows remote users to access on-premises web applications securely without a VPN, but it does not connect the on-premises data center to the cloud for hybrid workloads. ExpressRoute is required for a dedicated private connection.
Go deeper
Related to this question
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.