hardMultiple SelectObjective-mapped
SC-100 Virtual Network Gateway Practice Question
Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?
⚠ Common exam trap
Candidates often confuse the virtual network gateway with the VPN gateway, thinking they are separate components, and may omit the public IP address. However, the virtual network gateway (option D) is the actual Azure resource, and the VPN gateway is a configuration type. Additionally, a public IP address is a required resource that must be created and assigned to the gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Public IP address for the VPN device
To implement a secure hybrid network with Azure using a site-to-site VPN, three components are required: a virtual network gateway (which provides the VPN termination), a local network gateway (which represents the on-premises network), and a public IP address (which is assigned to the virtual network gateway to enable communication over the internet). The VPN gateway (option C) is not a separate component; it is a type of virtual network gateway. An ExpressRoute circuit (option B) is for dedicated private connections, not VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Public IP address for the VPN device
Why this is correct
A public IP address is required for the Azure VPN gateway to be reachable from the on-premises VPN device. This IP is assigned to the gateway's IPsec tunnel endpoint and must be a standard SKU public IP, which can be dynamic or static. Without this publicly routable address, the on-premises device cannot initiate or complete the IPsec connection, making it a mandatory component for a site-to-site VPN.
- ✗
ExpressRoute circuit
Why it's wrong here
An ExpressRoute circuit is incorrect because it provides a dedicated private connection to Azure via a service provider, not an internet-based IPsec VPN. It is an alternative hybrid connectivity option, not a component of a site-to-site VPN design. Including ExpressRoute would require a completely different set of resources (e.g., a virtual network gateway with ExpressRoute-type, circuits, and provider configurations), so it does not belong in this list of required VPN components.
- ✗
VPN gateway (route-based)
Why it's wrong here
A route-based VPN gateway is a type of virtual network gateway, not a separate Azure resource. The question already includes 'virtual network gateway' as a required component; adding 'VPN gateway (route-based)' would be redundant because the virtual network gateway is the actual resource that is configured as route-based (or policy-based). In practice, you deploy one virtual network gateway, and its type (route-based or policy-based) is a property, not an additional component, so this option is incorrect as a distinct requirement.
- ✓
Virtual network gateway
Why this is correct
The virtual network gateway is the Azure resource that terminates the IPsec tunnel on the cloud side. It is deployed in a dedicated subnet (GatewaySubnet) and routes traffic between the virtual network and on-premises networks via the VPN connection. This gateway is essential because it handles the encryption, decryption, and routing for the site-to-site VPN, making it a correct and required component for a secure hybrid network.
- ✓
Local network gateway
Why this is correct
A local network gateway is a logical object in Azure that represents the on-premises site, including its public IP address (of the on-premises VPN device) and its address space. It is required so the Azure virtual network gateway knows where to route traffic and what IPsec peers to authenticate. Without the local network gateway, Azure would have no reference to the remote network, so it is a mandatory configuration object for a site-to-site VPN.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.