Consultants working from home laptops need encrypted access to resources in an Azure virtual network. The firm does not want to buy VPN hardware for any location. Which connectivity option fits best?
Show answer and explanation
Answer: D
Point-to-site VPN creates an encrypted tunnel from individual client devices, such as laptops, to an Azure virtual network. No VPN hardware is needed at the contractor's home, and authentication can use certificates or Microsoft Entra ID. Site-to-site VPN links whole networks, ExpressRoute Direct is a dedicated private circuit for enterprises, and VNet peering only joins Azure networks together.
Why the other options are wrong
- A. Site-to-site VPN connects an entire network to a virtual network and requires a compatible VPN device at the remote site. Individual consultants on laptops cannot use it without dedicated hardware.
- B. ExpressRoute Direct provides dedicated private ports into Microsoft edge routers for large enterprises, not internet-based access for individual devices. It does not satisfy the remote, no-hardware requirement.
- C. VNet peering joins two Azure virtual networks over the Microsoft backbone. It cannot be extended to a contractor's home network or laptop, so it does not provide client access.