You read an AZ-305 hybrid networking scenario, and VPN Gateway and ExpressRoute both look like the answer. Decide from where the traffic has to travel. Encrypted over the public internet points to VPN Gateway. A private path with predictable latency points to ExpressRoute. Many branches and transit across regions point to Virtual WAN. The other answer choices test whether you can keep the separate layers apart.
The exam measures this directly. The current study guide lists "Recommend a connectivity solution that connects Azure resources to on-premises networks" under the Design network solutions task group, in the Design infrastructure solutions domain, which is 30-35% of the exam (skills measured as of April 17, 2026) (AZ-305 study guide). The same task group carries recommendations for network performance, network security, and load-balancing and routing. Recheck the study guide before you book, because Microsoft dates the skill list (AZ-305 exam page).
The layers a scenario is really choosing
The trap is treating the answer choices as substitutes. They are layers. VPN Gateway, ExpressRoute, and Virtual WAN carry traffic between your network and Azure. Whether you manage the transit yourself in a hub-and-spoke design or let Microsoft manage it in Virtual WAN is a separate decision. Private Link changes how one client reaches one service. Name resolution decides whether the app actually uses the private path.
A scenario that stacks a datacenter, branches, a PaaS service, and remote admins is testing whether you can split those layers. Answer each layer separately before you pick.
The cues that pick the transport
Match the scenario's wording to the path before you look at the answer choices.
- "Encrypted tunnel over the internet," one site or a few, remote users, or a modest budget point to VPN Gateway. Microsoft's hybrid connectivity page describes it as secure site-to-site connectivity between on-premises networks and Azure virtual networks, plus point-to-site connectivity for individual devices, over IPsec and IKE encrypted connections on the public internet (Azure hybrid connectivity).
- "Traffic must not traverse the public internet," "predictable latency," "high bandwidth," or "mission-critical" point to ExpressRoute. The same page's comparison table says ExpressRoute traffic never traverses the public internet (Azure hybrid connectivity).
- "Many branches," "SD-WAN devices," or "multiple Azure regions" point to Virtual WAN, Microsoft's hub-and-spoke service that simplifies the deployment and management of branch connectivity (Azure hybrid connectivity).
Each service, and where it stops
VPN Gateway
Pick VPN Gateway when the scenario needs site-to-site or point-to-site encrypted tunnels, or a lower-cost hybrid path that can tolerate public-internet latency.
The hybrid connectivity page's comparison table gives the exam numbers. VPN traffic is encrypted but traverses the public internet, the gateway runs up to 10 Gbps aggregate on the VpnGw5 SKU, and higher latency is acceptable. The budget row says lower cost, a per-hour gateway fee plus data transfer charges (Azure hybrid connectivity).
Boundary: the encryption does not make it a private path. If the requirement says the traffic must not traverse the public internet, VPN Gateway is out regardless of encryption.
ExpressRoute
Pick ExpressRoute when the design needs a private path, consistent latency, or bandwidth beyond what a VPN gateway carries.
The comparison table says ExpressRoute traffic never traverses the public internet. The ExpressRoute introduction adds that the private connection offers more reliability, faster speeds, consistent latencies, and higher security than typical internet connections, and that routes are exchanged dynamically with BGP, an industry standard dynamic routing protocol (ExpressRoute introduction).
The comparison table sets the bandwidth. An ExpressRoute circuit carries up to 100 Gbps, and ExpressRoute Direct supports up to 400 Gbps. The largest VPN Gateway SKU, VpnGw5, carries up to 10 Gbps aggregate. That gap is what the high-bandwidth cue is measuring (Azure hybrid connectivity).
The resiliency guidance is specific, and it is worth memorizing as written. Each circuit consists of two connections to two Microsoft Enterprise edge routers. For maximum resiliency, Microsoft recommends two circuits in two peering locations. For non-production and non-critical workloads, a single circuit with redundant connections within one peering location is the standard resiliency level (ExpressRoute introduction).
Boundary: ExpressRoute does not remove the routing design. In a hub-and-spoke layout, spokes do not deploy their own ExpressRoute gateway. They use the centralized solution the hub provides (hub-spoke architecture).
Virtual WAN
Pick Virtual WAN when the scenario is a network of networks. Many branches, remote users, SD-WAN devices, multiple Azure regions, and a mix of VPN and ExpressRoute connections.
Microsoft describes Virtual WAN as a networking service that provides optimized and automated branch-to-branch, branch-to-Azure, and Azure-to-Azure connectivity on a unified hub-and-spoke architecture, supporting VPN, ExpressRoute, and SD-WAN. Its use-case list includes connecting multiple Azure regions and on-premises networks by using a single Virtual WAN hub (Azure hybrid connectivity).
The same page's decision guidance maps straight onto the exam. A small business with limited bandwidth starts with VPN Gateway. A business that grows into higher bandwidth and lower latency moves to ExpressRoute. A network that expands to multiple branches gets Virtual WAN to simplify deployment and management of branch connectivity (Azure hybrid connectivity).
Boundary: for a single site or a single datacenter path, Virtual WAN is the wrong scale. A hub adds nothing when the design only has two networks to connect.
Hub-and-spoke
Pick a traditional hub-and-spoke design when the scenario wants you to manage the routing. A shared hub virtual network, spokes connected by peering, and a gateway or firewall placed by you.
The reference architecture is specific about peering behavior. Virtual network peering connections are nontransitive, low-latency connections between virtual networks, and in a hub-spoke architecture you use direct peering between virtual networks only in special circumstances. If two spokes need to talk, add a peering between those spokes or place them in the same network group. To reach on-premises through the hub gateway, you configure the hub peering to allow gateway transit (hub-spoke architecture).
The architecture also names the failover combination the exam likes. For higher availability, you can use ExpressRoute and a VPN for failover (hub-spoke architecture).
Boundary: when the scenario says Microsoft-managed hub routing, or many branches with SD-WAN, the answer is Virtual WAN, not a hand-built hub.
Private Link and private endpoints
Pick Private Link when the scenario says a service must be reachable only through a private IP.
Microsoft defines a private endpoint as a network interface that uses a private IP address from your virtual network, and that connects you privately and securely to a service powered by Azure Private Link (private endpoint overview).
Two boundaries matter for the exam. Private Link is a service-level boundary, not a WAN. It changes how a client reaches one resource, and it does not connect a branch or a datacenter to Azure. And the private path only works if the name resolves to the private endpoint's IP. A scenario that asks how an on-premises client reaches a private endpoint is also asking about DNS.
Name resolution is its own layer
A private network path does nothing if the app resolves the service name to a public address. For a private endpoint, the service name has to resolve to the private endpoint's IP for the client to use the private path.
The exam tests this as a second step inside a Private Link scenario. The scenario gives you the private endpoint and asks how an on-premises app reaches it. The answer is the name-resolution step. When a scenario needs names to resolve across the on-premises and Azure boundary, the service to name is DNS Private Resolver.
The decision in one table
| VPN Gateway | ExpressRoute | Virtual WAN | |
|---|---|---|---|
| Where the traffic travels | Encrypted over the public internet | Private path. Traffic never traverses the public internet | Hub-and-spoke. Each connection can be VPN, ExpressRoute, or SD-WAN |
| The scenario cue | A small site, a lab, remote users, a modest budget | "Must not traverse the public internet," predictable latency, high bandwidth | Many branches, SD-WAN devices, multiple Azure regions |
| Where it fails | A stated private path or latency requirement | A single small lab where the cost line matters | A single-site or single-datacenter design |
| Verdict | Encrypted internet connectivity at modest scale | The private, predictable, high-bandwidth path | Large-scale managed transit |
The rows come from Microsoft's hybrid connectivity comparison and the ExpressRoute introduction (hybrid connectivity, ExpressRoute introduction).
Worked scenario: three branches, one datacenter, and private SQL
A company has one datacenter, three small branches, two Azure regions, and a payment application in a spoke VNet. The app must reach Azure SQL privately. Admins work remotely. The company expects ten more branches next year.
Work the layers.
Transport. The datacenter path carries the payment traffic, so it is the load-bearing decision. The requirement is a predictable, private path, so ExpressRoute serves that path and the VPN gateway stays as the failover option. The hub-spoke architecture documents exactly this combination. For higher availability, you can use ExpressRoute and a VPN for failover.
Transit. Three branches today and ten more next year, and the growth will bring SD-WAN devices. That stack points to Virtual WAN. Many branches, multiple connectivity types, and multiple regions behind a single hub. If the scenario stopped at one datacenter and three small branches on plain site-to-site VPN, a traditional hub with VPN Gateway would be the right scale. The growth clause is what moves the answer.
Azure side. Put the shared connectivity, the ExpressRoute gateway and the VPN gateway, in a hub. Put the payment application tiers in spokes. The spokes use the hub's gateway for on-premises reach, because spokes do not deploy their own ExpressRoute gateway.
Service boundary. Azure SQL gets a private endpoint, so the app reaches it through a private IP in the VNet.
Name resolution. Configure DNS so the app resolves Azure SQL to the private endpoint's IP. If on-premises clients also need the name, add DNS Private Resolver to the design.
Exam-ready answer. Pick ExpressRoute for the load-bearing datacenter path with VPN failover, pick Virtual WAN for the branch growth and multi-region transit, put the shared connectivity in a hub, give Azure SQL a private endpoint, and finish with the DNS step. The choices name four layers, and a complete answer covers all of them.
What the wrong answer reveals
Read each wrong choice as a signal about which layer you misread.
- ExpressRoute for one small lab. You weighted "private" more heavily than the cost and the operational work a circuit requires. The budget row in the comparison table is what points back to VPN Gateway.
- VPN Gateway for a high-bandwidth, mission-critical datacenter path. You missed the private-circuit and predictable-latency cues. Encryption over the internet does not satisfy a must-not-traverse-the-internet requirement.
- A traditional hub-and-spoke for dozens of branches across regions. You missed the Microsoft-managed transit and SD-WAN cues that point to Virtual WAN.
- Private Link to connect a branch office. The misconception is treating service-level private access as WAN connectivity. A private endpoint changes how one client reaches one service. It does not connect a site to Azure.
- Forgetting DNS. The network diagram works, but the app resolves the name to the public endpoint and never uses the private path.
- Assuming VNet peering is transitive. Peering is nontransitive, so two spokes do not talk through a third. The fix is a direct peering, a connected group, or a route through the hub with gateway transit.
When you work practice scenarios, label each wrong answer with the layer it fails on. Transport, transit, service boundary, or name resolution. That label is a better repair target than rereading every networking page.
A drill for this boundary
Take one scenario and change a single requirement at a time. Read the answer again before you change the next requirement.
- Replace "small branch" with "50 branches using SD-WAN." Does Virtual WAN become the stronger answer?
- Add "traffic must not traverse the public internet." Does ExpressRoute become the stronger answer?
- Add "remote developers need laptop access." Does point-to-site VPN enter the design?
- Add "the database must be reachable only through a private IP." Does Private Link become the service boundary?
- Add "on-premises apps must resolve the private endpoint name." Does DNS Private Resolver enter the design?
The drill works because the correct answer changes when the architecture boundary changes, and the scenario's wording is what moves the boundary.
Next step
If hybrid networking questions still cost you points, take the free AZ-305 assessment. It returns a Readiness Report with your top gaps (free AZ-305 assessment). For each wrong networking answer, write one sentence naming the layer you misread, such as "I treated a service-level private access requirement as a WAN requirement." Fix that layer, then work the nearby scenarios again.
When you want the full prep, the AZ-305 Pass Plan is your ranked list of targeted repair tasks. While you keep working these scenarios, CramHQ catches the new gaps your misses reveal, measures each one by the points it costs on the exam, and opens the plan with the repair for your costliest layer. Each repair task starts from a wrong answer you gave. It shows the trap the question set, the rule that decides the right layer, a worked example, and a retest on fresh questions. The practice tests and the timed final simulation check your readiness along the way. The path is US$34.99 for 12 months of access, and the first repair is free (AZ-305 course).