AZ104-Q: VNet peering vs VPN gateway (private connectivity)
Q: Two VNets must communicate privately over Microsoft’s backbone with no per-gateway deployment needed, i.e. you want no intermediate device (no virtual network gateway) between them. Which should you use?
- A) Site-to-Site VPN Gateway
- B) ExpressRoute
- C) VNet peering (incl. Global VNet peering) ✓
- D) Public IP on each VM
Answer: C — VNet peering. VNet peering connects VNets directly over Microsoft’s backbone — it does not require a gateway device and does not create an intermediate hop. Site-to-Site VPN Gateway is for connecting to on-premises or VNet-to-VNet over the internet through a gateway; ExpressRoute is premium private connectivity but is a dedicated premis-circuit service. Peering is the right tool for direct, backbone-based VNet-to-VNet connectivity.
⚠ Note on cost: VNet peering data transfer is billed normally like other Azure egress — the property to remember is “no gateway / direct backbone connection”, not “free transfer”. (Billed egress applies in both peering and other paths.)
Why it helps
Distinguish peering (direct, gateway-less, backbone) from VPN Gateway (needs a gateway, for on-prem/VNet-over-internet) and ExpressRoute (premise circuit). Avoid the false claim that peering data transfer is free.