How Azure resources talk to each other, to the internet, and back to your on-premises network — and the one distinction (VPN Gateway vs. ExpressRoute) the exam leans on hardest in this topic.
Your company needs the most reliable, highest-bandwidth, lowest-latency connection between its on-prem datacenter and Azure — for a compliance-sensitive workload where traffic must never touch the public internet. Do you reach for a VPN Gateway or ExpressRoute? Keep your answer in mind.
An Azure Virtual Network (VNet) is a private, isolated network in Azure — resources inside it can talk to each other, to the internet, and to your on-premises network. You divide a VNet's IP address space into subnets to segment and organize resources within it. That address space isn't internet-routable on its own — it only exists inside the VNet.
Public endpoint — has a public IP address, reachable from anywhere on the internet. Private endpoint — lives inside a VNet with a private IP from that VNet's address space, reachable only from within.
VNet peering connects two virtual networks directly to each other — even across regions — with traffic traveling over the Microsoft backbone network, never the public internet. It's the private, VNet-to-VNet equivalent of what ExpressRoute does for on-prem-to-Azure traffic.
Two fundamentally different approaches, and this is the pair the exam tests hardest:
| VPN Gateway | ExpressRoute | |
|---|---|---|
| Path | Encrypted tunnel over the public internet | Dedicated private connection via a connectivity provider — never touches the public internet |
| Reliability/latency | Good, but subject to public internet conditions | Higher reliability, more bandwidth, consistent low latency |
| Typical use | Cost-sensitive, moderate-traffic connections; quick to set up | Compliance-sensitive, high-throughput, latency-critical workloads |
| Availability by default | Deployed active/standby automatically for failover | Built-in redundancy at every peering location |
VPN Gateway itself offers three connection shapes: site-to-site (on-prem gateway ↔ Azure VNet), point-to-site (a single device, like a laptop, connecting into the VNet), and VNet-to-VNet (two Azure virtual networks, as an alternative to peering).
Calibration answer: ExpressRoute — it's the only option here that guarantees traffic never touches the public internet, with the reliability and bandwidth profile the scenario demands. One gotcha worth knowing: even over an ExpressRoute connection, DNS queries and CDN requests still travel over the public internet — ExpressRoute privatizes your data path, not literally everything.
Azure DNS hosts DNS domains and resolves names using Azure's global, anycast network — each query gets answered by the closest available server. It integrates with Azure RBAC, activity logs, and resource locks like any other Azure resource, and supports private DNS domains inside a VNet.
Gotcha: Azure DNS hosts and manages DNS records — it does not sell or register new domain names. You buy the domain elsewhere (or via App Service domains) and then host its records in Azure DNS.