Connecting an on-premises network to an Azure VNet site-to-site over the internet requires which Azure-side resource?
A.ExpressRoute circuit
ExpressRoute is dedicated private circuits — the OTHER option, not internet VPN.
B.VPN Gateway + local network gateway
VPN GW + local network GW = the S2S pair. Correct.
C.Application Gateway
Application Gateway is L7 load balancing — unrelated.
D.NAT gateway
NAT gateway is outbound SNAT — unrelated.
Why this answer
Site-to-site VPN needs a VPN Gateway in the Azure VNet plus a local network gateway representing the on-prem VPN device (public IP + shared key + address spaces). ExpressRoute is the private-circuit alternative — completely different connectivity model.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Virtual Networking practice session.
Practice Virtual Networking