Providing Remote Worker Access to Azure VMs on VNet1

AZ-104 By islever Editorial Last updated

Configure secure access to virtual networks

Short answer

C Configure a Point-to-Site (P2S) VPN gateway so each remote worker's device can establish a secure tunnel directly to VNet1.

Question

Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1.
The company has users that work remotely. The remote workers require access to the VMs on VNet1.
You need to provide access for the remote workers.
What should you do?
  1. Configure a Site-to-Site (S2S) VPN.
  2. Configure a VNet-toVNet VPN.
  3. Configure a Point-to-Site (P2S) VPN. Correct Answer
  4. Configure DirectAccess on a Windows Server 2012 server VM.
  5. Configure a Multi-Site VPN

Key Takeaways

The question tests choosing the right VPN topology for individual remote users; the trap is picking Site-to-Site or Multi-Site VPN, which connect whole on-premises networks or branches rather than single client devices.

This AZ-104 scenario asks how to give individually working remote employees secure connectivity to VMs inside a single Azure virtual network (VNet1). The correct answer is a Point-to-Site (P2S) VPN gateway connection, which lets each telecommuter's client computer dial a secure tunnel directly to the VNet without needing an on-premises VPN device.

Common mistake: Option A (Site-to-Site VPN) is the most common wrong pick: learners assume 'remote access' means connecting an office network to Azure, but S2S requires a dedicated on-premises VPN appliance at a fixed site and is designed for connecting networks, not individual roaming workers.

Expert Analysis

Why the Answer Is Correct

A Point-to-Site (P2S) VPN gateway connection creates a secure IPsec/IKE tunnel from an individual client computer to an Azure virtual network. Microsoft explicitly positions P2S as the solution for telecommuters who connect from locations such as home, a hotel, or a conference, which matches this scenario exactly since the remote workers are people, not branch offices. The connection is initiated from the client side using a VPN client package, so no on-premises hardware, public static IP, or local IT presence is required. Once connected, each remote worker receives an IP from the VNet's address space and can reach the VMs on VNet1 directly.

Why the Other Options Are Wrong

Option A (Site-to-Site VPN) links an entire on-premises network to a VNet through a compatible VPN device with a public IP; it is appropriate only when the remote workers all sit behind one fixed corporate site, which the question does not state. Option B (VNet-to-VNet VPN) connects two Azure VNets to each other and provides no path for external client devices. Option D is doubly wrong: DirectAccess is deprecated and was removed in Windows Server 2022, and it would still require deploying and maintaining a gateway server rather than using the managed Azure VPN gateway. Option E (Multi-Site VPN) extends S2S by connecting multiple on-premises sites to one VNet, so it inherits the same requirement for fixed locations and VPN appliances.

Community Comment Notes

The community converged on option C, and the reasoning is sound. As lglars noted, "S2S would be better if you know that the remote workers work from one location, but we don't know that." xRiot007 reinforces the distinction by arguing that confining remote workers to a single location "is not remote work anymore, that is an office branch." JohnPhan and myarali both quote Microsoft's own guidance that a P2S connection "is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference," while LPaul gives a concise mnemonic: "SITE to Site = Vpn to Vpn, Point to Site = remote (Device) to Vpn."

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

In AZ-104 networking questions, match the connection scope to the initiator: individual devices mean Point-to-Site, on-premises networks mean Site-to-Site, and Azure-to-Azure VNets mean VNet-to-VNet. Whenever the question says users/telecommuters/laptops rather than a branch or headquarters, P2S is almost always the intended answer.

Frequently Asked Questions

Can remote workers reach Azure VMs without a Point-to-Site VPN at all?

Alternatives such as Azure Bastard (Bastion) or RDP over a public IP exist, but among the listed VPN options only P2S targets individual client devices, making it the intended AZ-104 answer.

More AZ-104 FAQ →

Discussion 34 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 34

  1. lglars 👍 37
    Correct, S2S would be better if you know that the remote workers work from one location, but we don't know that. They could be working from different locations(like home) that's why P2S is better.
  2. xRiot007 👍 22
    P2S is the correct answer. Remote work can be done from anywhere at anytime. If you condition your remote workers to work from one location, that is not remote work anymore, that is an office branch.
  3. JohnPhan 👍 8
    Answer C A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about
  4. Mazinger 👍 7
    The appropriate solution to provide remote workers access to VMs on VNet1 is to configure a Point-to-Site (P2S) VPN. A P2S VPN allows individual remote computers to connect securely to an Azure virtual network. This solution is ideal for remote workers because it does not require the workers to have an on-premises VPN device, and it allows the workers to access the virtual network resources from anywhere with an internet connection. Site-to-Site (S2S) VPNs and VNet-to-VNet VPNs are used to connect two or more networks together. DirectAccess is a deprecated technology that is not recommended for new deployments. Multi-Site VPN is used to connect multiple on-premises sites to a single Azure virtual network.
  5. BowSec 👍 7 Answered C
    C. Configure a Point-to-Site (P2S) VPN. To provide access for remote workers to virtual machines (VMs) hosted in Microsoft Azure, you can use a Point-to-Site (P2S) VPN connection. This type of connection enables individual remote clients to securely connect to an Azure virtual network (VNet) over the Internet. A Site-to-Site (S2S) VPN connection is used to connect two or more on-premises networks to an Azure virtual network (VNet), while a VNet-to-VNet VPN connection is used to connect two or more Azure virtual networks (VNets) together.
Show 25 more comments
  1. LPaul 👍 7
    SITE to Site = Vpn to Vpn , Point to Site = remote ( Device )to Vpn
  2. verifedtomic 👍 6 Answered C
    C is correct. Point to Site (P2S) VPN is intended to be used by remote workers.
  3. nonia 👍 4 Answered C
    Point-to-Site (P2S) VPN is the most appropriate option in this scenario because it allows remote users to securely connect from their individual devices (e.g., laptops, tablets) to an Azure virtual network (VNet1). This is typically used when users need to access Azure resources like VMs remotely over the internet.
  4. myarali 👍 3 Answered C
    A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet.
  5. MrJR 👍 3
    A S2S VPN also would work but they say that "the company has users that work remotely" so I guess that not all company users work remotely in which case a S2S VPN would fit. For only some remote workers fits better a P2S VPN. But's a tricky question.
  6. pappkarcsiii 👍 3 Answered C
    edengoforit Most Recent 4 days, 21 hours ago Answer is C: A Point-to-Site (P2S) VPN
  7. Madbo 👍 2
    C the correct one. A P2S VPN is a secure connection between a remote computer and a virtual network. It enables remote workers to securely connect to the virtual network over the Internet. With P2S VPN, the remote worker can connect to VNet1 from their client computer, and then access the VMs in VNet1.
  8. edengoforit 👍 2
    Answer is C: A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer.
  9. EmnCours 👍 2 Answered C
    Correct Answer: C 🗳️ A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer.
  10. TheUnit720 👍 2
    Answer C is correct This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference.
  11. Ateeyah 👍 2
    i guess the S2S is better in this case , because maybe there are many users works remotly at the same time who confirm ???? if not , please till us why ?
  12. Sahar_A 👍 2 Answered C
    Point-to-site VPN is the answer, no guarantee that all remote workers in the same location for the Site to site-to-site option
  13. whatzapp95 👍 2
    Correct, the best solution is P2S to allow the user to access to VM via VPN
  14. ping 👍 2
    No, s2s is between offices etc. not from end/remote users
  15. ckanoz 👍 2 Answered C
    C is the correct Answer
  16. Miguel Angel 👍 1 Answered C
    El requisito es: Los usuarios trabajan de forma remota y necesitan acceder a las máquinas virtuales que están en VNet1. La solución diseñada específicamente para conectar equipos individuales (portátiles o estaciones de trabajo de usuarios remotos) a una red virtual de Azure es una Point-to-Site (P2S) VPN. Con una P2S: Un usuario se conecta desde su equipo directamente a Azure. No requiere una VPN en la ubicación del usuario. Es ideal para teletrabajadores y administradores remotos.
  17. byuq 👍 1
    Please note: "The company has users that work remotely" is this case they probably work from different locations. For them to connect to the VMs you can't configure S2S for all, it's P2S. "C" is very correct.
  18. rolo5555 👍 1
    Answer C: "This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference"
  19. NaoVaz 👍 1 Answered C
    Point-to-Site Connection topology seems to be the best fit for the described scenario.
  20. Naru60 👍 1 Answered C
    This is easy question. A remote worker uses normally P2S.
  21. maheshwariravi 👍 1
    Correct answer is C:-P2S
  22. dhivyamohanbabu 👍 1
    Option C is correct
  23. Quetzalcoatl 👍 1
    I think is S2S
  24. Blackpanther2255 👍 1
    Correct Ans C
  25. Anonymous learner 👍 1 Answered C
    Answer is C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Enable SSPR for Entra Identities

S-grade

Assigning Fabric Licenses in Entra ID Free Tenant

S-grade

Which Certificate from Vault1 for WebApp1 TLS?

S-grade

Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

S-grade

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide