Connecting on-premises to Azure: VPN and ExpressRoute

The two ways to link your own datacenter to an Azure virtual network — an encrypted VPN over the internet, or a private ExpressRoute circuit — with the VPN Gateway and the trade-offs pinned down. AZ-900, 2026 edition.

Here are 7 typical hybrid-connectivity questions in the exam's own style — free, each answer explained, no sign-up.

Straight to the 7 free questions ↓

Hybrid connectivity is one of the friendliest topics on the AZ-900: there are really only two ways to connect your own datacenter to an Azure virtual network (VNet), and the exam mostly tests whether you can tell them apart. The diagram above lays it out — an on-premises network on the left, an Azure VNet on the right, and two lines between them: a VPN over the public internet, and ExpressRoute as a private circuit. Learn those two paths and their trade-offs and this cluster of questions turns into free points.

VPN: an encrypted tunnel over the internet

A VPN connects you to a VNet with an encrypted tunnel that runs over the ordinary public internet. On the Azure side, the tunnel terminates at a VPN Gateway — a resource that lives inside the VNet, in its own gateway subnet. There are two flavours:

Site-to-Site (S2S) VPN — connects a whole on-premises network to the VNet. Your office and Azure behave like one connected network. Think “Site” = a whole site.
Point-to-Site (P2S) VPN — connects a single client device (a laptop) to the VNet. Perfect for one remote worker. Think “Point” = one point/device.

Both are encrypted, both use the internet, and both are cheaper and faster to set up than a private circuit — which is exactly why the exam frames a VPN as the budget-friendly choice.

ExpressRoute: a private, dedicated circuit

ExpressRoute is the other path. Instead of the public internet, it gives you a private, dedicated connection to Microsoft Azure arranged through a connectivity provider (a partner). Because it never touches the public internet, it delivers higher bandwidth, lower latency, and more predictable performance — and it is the answer whenever a scenario stresses privacy or compliance (“traffic must not cross the internet”).

The catch is cost and setup: ExpressRoute is a premium service that you provision with a provider, so it is not the quick, cheap option a VPN is.

VPN vs ExpressRoute — the one-line verdict

This is the comparison the exam loves:

Pick a VPN when cost and simplicity matter and you accept internet-based traffic.
Pick ExpressRoute when you need privacy, bandwidth, and predictable performance, and you can pay for a dedicated circuit.

VNet-to-VNet: connecting two virtual networks

One more connection type to know: a VNet-to-VNet connection links two Azure virtual networks together through their VPN gateways, so resources in each can communicate privately. It is a sibling of the Site-to-Site VPN — same gateway technology, but both ends are Azure VNets rather than one end being on-premises.

The real exam mixes multiple-choice, true/false, and drag-and-drop formats; the seven questions below are standard multiple-choice, and every explanation carries a “why not the others” so the wrong options teach you as much as the right one.

A diagram showing an on-premises datacenter on the left, containing a local network with servers and users, connected to a Microsoft Azure virtual network on the right two different ways. The Azure VNet contains a VPN Gateway, captioned as living inside the VNet, plus subnets and VMs. The top connection is labelled Site-to-Site VPN and drawn as a dashed line, captioned an encrypted tunnel over the public internet. The bottom connection is labelled ExpressRoute and drawn as a solid line that passes through a connectivity provider box before reaching Azure, captioned a private circuit that does not use the public internet. A caption underneath reads: two ways to reach a VNet from on-premises — a VPN, encrypted and over the internet, or ExpressRoute, private and dedicated.

7 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 7

A company wants to link its entire on-premises office network to an Azure virtual network so that servers on both sides can talk to each other, using an encrypted tunnel that runs over the public internet. Which Azure connection fits this need?

Answer: A — A Site-to-Site VPN through a VPN Gateway.

A Site-to-Site (S2S) VPN connects a whole on-premises network to an Azure VNet through a VPN Gateway, creating an encrypted IPsec tunnel that travels over the public internet — exactly the described scenario. Why not the others: a Point-to-Site VPN connects a single client device, not an entire office network. ExpressRoute is a private circuit that does not run over the public internet, so it does not match the 'encrypted tunnel over the internet' wording. Giving each VM a public IP exposes them individually and does not link the two networks. Pro tip: 'whole network to a VNet, encrypted, over the internet' is the Site-to-Site VPN signature.

AZ-900 Question 2 of 7

A single remote employee needs to reach resources in an Azure virtual network from their laptop while working from home, without connecting their whole home network. Which option is designed for one client device?

Answer: A — A Point-to-Site VPN.

A Point-to-Site (P2S) VPN connects an individual client computer to an Azure VNet — ideal for a single remote worker who does not need to link an entire on-premises network. Why not the others: a Site-to-Site VPN joins a whole network, which is more than one laptop requires. ExpressRoute is a dedicated private circuit for connecting locations, not a per-device remote-access option. VNet peering connects two Azure virtual networks to each other, not a laptop to a VNet. Pro tip: think 'Point' = one point/device, 'Site' = a whole site/network.

AZ-900 Question 3 of 7

An organization needs a connection between its datacenter and Microsoft Azure that does not travel over the public internet, and that offers higher bandwidth, lower latency, and more predictable performance. Which service should they choose?

Answer: A — ExpressRoute.

ExpressRoute provides a private, dedicated connection to Microsoft Azure through a connectivity provider — the traffic does not touch the public internet, and it delivers higher bandwidth, lower latency, and more predictable performance than a VPN. Why not the others: both Site-to-Site and Point-to-Site VPNs send their encrypted traffic across the public internet, so latency depends on the internet path. Azure Firewall is a network security service that filters traffic; it is not a connectivity link at all. Pro tip: 'private, not over the internet, predictable performance' points straight at ExpressRoute.

AZ-900 Question 4 of 7

A team is deciding between a VPN and ExpressRoute for connecting to Azure. They have a limited budget and only modest traffic, and they accept that the connection rides the public internet. Which choice best matches that priority?

Answer: A — A Site-to-Site VPN, because it is lower cost and quick to set up over existing internet.

When cost and simplicity matter more than guaranteed bandwidth or keeping traffic off the internet, a Site-to-Site VPN is the usual pick: it uses your existing internet connection and is cheaper and faster to stand up than a provisioned private circuit. Why not the others: ExpressRoute is a premium, provider-based service — it is not the cheapest option. A VPN is in fact encrypted, so that reasoning is wrong. And you are not required to use both; each is a valid standalone choice. Pro tip: VPN = lower cost over the internet; ExpressRoute = higher cost for privacy, bandwidth, and predictability.

AZ-900 Question 5 of 7

Two separate Azure virtual networks, each in a different region, need a private connection so their resources can communicate. Using gateways, which type of connection links one VNet directly to another?

Answer: A — A VNet-to-VNet connection.

A VNet-to-VNet connection links two Azure virtual networks together through VPN gateways, letting resources in each VNet communicate privately — the scenario described. Why not the others: a Point-to-Site VPN connects a single client device to a VNet, not two VNets. ExpressRoute is about reaching Azure from on-premises through a provider, not joining two VNets over gateways. A public load balancer distributes inbound traffic across VMs; it does not connect networks. Pro tip: 'VNet-to-VNet' does what it says — network to network, gateway to gateway.

AZ-900 Question 6 of 7

You are setting up a Site-to-Site VPN to an Azure virtual network. Where does the Azure-side VPN Gateway that terminates the tunnel actually reside?

Answer: A — Inside the virtual network, in its own gateway subnet.

The Azure VPN Gateway is a resource that lives inside the virtual network — deployed into a dedicated gateway subnet — and it terminates the encrypted tunnel on the Azure side, as the diagram shows. Why not the others: your on-premises side has its own VPN device, but the Azure gateway is not in your datacenter. A VPN Gateway cannot exist without a VNet to attach to, so a VNet-less subscription is impossible. And the gateway is a network-level resource, not something installed per VM NIC. Pro tip: the Azure VPN Gateway always belongs to a VNet — remember the gateway subnet.

AZ-900 Question 7 of 7

A regulated business must ensure its traffic to Azure never crosses the public internet, for compliance reasons, and is willing to work with a connectivity provider to arrange it. Which statement about ExpressRoute is correct?

Answer: A — ExpressRoute uses a private connection through a provider and does not go over the public internet.

ExpressRoute establishes a private, dedicated connection to Microsoft Azure through a connectivity provider, and its traffic bypasses the public internet entirely — which is exactly what a compliance requirement like this calls for. Why not the others: it is not a VPN and does not ride the public internet, so the first distractor is false. Connecting a single laptop describes a Point-to-Site VPN, not ExpressRoute. And ExpressRoute is a billed service arranged with a provider — it is not free with every subscription. Pro tip: whenever a question stresses 'must not use the public internet' or 'private connection,' the answer is ExpressRoute.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

What is the difference between a VPN and ExpressRoute in Azure?

A VPN (Site-to-Site or Point-to-Site) sends encrypted traffic to your Azure virtual network over the public internet through a VPN Gateway — it is lower cost and quick to set up. ExpressRoute instead gives you a private, dedicated connection through a connectivity provider that does not use the public internet, with higher bandwidth, lower latency, and more predictable performance. In short: VPN for lower cost over the internet, ExpressRoute for privacy, bandwidth, and predictability.

Does ExpressRoute use the public internet?

No. ExpressRoute is a private, dedicated circuit arranged through a connectivity provider, and its traffic does not travel over the public internet. That is the main reason organizations with compliance or performance requirements choose it over a VPN, whose encrypted traffic does cross the internet.

Are these real exam questions?

No. They are our own questions, written in the style and difficulty of the AZ-900 — never copied from any question bank or the real exam. Reproducing live exam items violates Microsoft's certification agreement and can cost a candidate their certification, and a crammed answer teaches you nothing about the one you have not seen.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.