AZ104-Q: Site-to-Site VPN vs ExpressRoute
Q: On-premises servers must connect to a VNet over the public internet, using encrypted IPsec, with no private dedicated circuit. Which option is the correct, lowest-cost fit?
- A) ExpressRoute
- B) Site-to-Site VPN Gateway ✓
- C) VNet peering
- D) Azure Front Door
Answer: B — Site-to-Site VPN Gateway. A Site-to-Site VPN connects on-premises to Azure over the public internet through encrypted IPsec/IKE tunnels, with no dedicated private line. ExpressRoute uses a dedicated private connection to a provider (not the public internet), higher throughput/latency guarantees, but higher cost and longer setup. VNet peering connects two Azure VNets, not on-premises. Front Door is a global CDN/entry point.
Why it helps
VPN Gateway = encrypted over the internet; ExpressRoute = private dedicated circuit. The question keywords “public internet” + “encrypted IPsec” → VPN Gateway.