Configuring Point-to-Site VPN for Remote Azure VM Access

AZ-900 By islever Editorial Last updated

Describe Azure compute and networking services

Short answer

C Configure a Point-to-Site (P2S) VPN to allow individual remote workers to connect securely to the Azure Virtual Network.

Question

Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1.
The company has users that work remotely. The remote workers require access to the VMs on VNet1.
You need to provide access for the remote workers.
What should you do?
  1. Configure a Site-to-Site (S2S) VPN.
  2. Configure a VNet-toVNet VPN.
  3. Configure a Point-to-Site (P2S) VPN. Correct Answer
  4. Configure DirectAccess on a Windows Server 2012 server VM.
  5. Configure a Multi-Site VPN

Key Takeaways

The exam tests the distinction between site-based and point-based connectivity; the common trap is selecting Site-to-Site (S2S) when only individual users, not entire branch networks, need access.

This question addresses the correct method for granting individual remote workers secure access to an Azure Virtual Network (VNet). It establishes that a Point-to-Site (P2S) VPN is the standard solution for connecting individual client devices directly to a VNet over the internet.

Common mistake: Candidates often choose Option A (Site-to-Site VPN) because they associate 'remote access' with corporate branches. However, S2S requires a physical gateway at the remote end, which is unnecessary and incorrect for individual telecommuters.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because a Point-to-Site (P2S) VPN connection allows individual client computers to connect securely to an Azure Virtual Network. This architecture is specifically designed for scenarios where remote workers (points) need to access resources within a central network (site) without requiring a dedicated on-premises hardware gateway at each user's location.

Why the Other Options Are Wrong

Option A (Site-to-Site VPN) connects an entire on-premises network to Azure via a gateway, which is inefficient for individual users. Option B (VNet-to-VNet) connects two Azure VNets, not external clients. Option D (DirectAccess) is a legacy Windows Server feature that is complex to deploy and generally superseded by modern cloud-native solutions like P2S or Azure AD Join/Entra ID. Option E (Multi-Site) is used when connecting multiple on-premises sites to a single Azure gateway, irrelevant for individual remote workers.

Community Comment Notes

The community consensus strongly supports Option C. As BinuRaj noted, "A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer." Multiple users confirmed that P2S is the ideal solution for telecommuters accessing a VNet from home or conference locations, distinguishing it from site-based connections.

Official Reference

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always identify the 'endpoint' type in the scenario: if it is a single device/user, think Point-to-Site; if it is a whole office/network, think Site-to-Site. Avoid getting distracted by legacy technologies like DirectAccess unless the question explicitly mentions Windows Server infrastructure constraints.

Frequently Asked Questions

Why not use DirectAccess for remote workers?

DirectAccess is a legacy Windows Server technology requiring complex deployment and specific infrastructure. P2S VPN is simpler, cloud-native, and supported by Azure Gateway natively.

Is P2S VPN suitable for large numbers of users?

Yes, but for very large scale, consider Azure Firewall or application-level authentication. P2S is optimal for typical remote worker scenarios up to several thousand concurrent connections.

More AZ-900 FAQ →

Discussion 51 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 51

  1. BinuRaj 👍 113
    Correct Answer. A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. ... P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet.
  2. IndyB 👍 50
    Answer = C. For people who want to read more about the VPN Gateway designs (point-to-site, site-to-site, VNet to VNet etc.), use this link to learn more: https://docs.microsoft.com/en-us/azure/vpn-gateway/design
  3. costalee 👍 15
    Thank you for the explaination
  4. emptyH 👍 7 Answered C
    Point = the remote user. Site = the Vnet. If the users have P2S they can hit the vnet on a per user basis.
  5. Petergrayston 👍 5
    Correct. Point-to-Site VPN connection (VPN over OpenVPN, IKEv2, or SSTP), which lets you connect to your virtual network from a remote location, such as from a conference or from home. Source: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways
Show 25 more comments
  1. Wan13 👍 5
    Point - to - Site (employee) (company) = C
  2. sudara 👍 4
    C. Configure a Point-to-Site (P2S) VPN. To provide remote workers with access to the virtual machines (VMs) in the Azure virtual network (VNet), you should configure a Point-to-Site (P2S) VPN. P2S VPN allows individual remote clients to securely connect to the Azure VNet over the internet using a VPN client installed on their computer. This enables the remote workers to access the resources within VNet as if they were connected directly to the virtual network.
  3. chol89435 👍 4
    thanks for the source
  4. cnuila 👍 3 Answered C
    A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet. https://learn.microsoft.com/en-us/azure/vpn-gateway/design#P2S
  5. Lanka22 👍 2 Answered C
    A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet
  6. Kenisworld666 👍 2 Answered C
    You can also create a Point-to-Site VPN connection (VPN over OpenVPN, IKEv2, or SSTP), which lets you connect to your virtual network from a remote location, such as from a conference or from home. https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways
  7. iwarakorn 👍 2
    Answer is C You can also use P2S instead of a Site-to-Site VPN when you have only a few clients that need to connect to a VNet. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal
  8. pmish05 👍 2
    Point -to-site should be the correct answer as the person has to connect from outside network to Azure network.
  9. ElPitu97 👍 2 Answered C
    https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about
  10. ContosoUser 👍 2 Answered C
    Point-to-site VPN is correct.
  11. Ankit_1 👍 2
    Answer is c PtoS for remotely
  12. arya93 👍 2 Answered C
    Correct answer is P2S
  13. Mouhammad1 👍 2
    P2S. Vpn gatway
  14. jaksonfaust1986 👍 2
    Answer is C
  15. intentando 👍 2 Answered C
    C
  16. Pefl 👍 1 Answered C
    Una VPN punto a sitio (Point-to-Site, P2S) permite que usuarios remotos individuales se conecten de manera segura a la red virtual de Azure (VNet1) desde sus dispositivos, sin necesidad de infraestructura adicional en el lugar. • Las opciones Site-to-Site (S2S) y VNet-to-VNet están pensadas para conectar redes completas entre sí (por ejemplo, la red de una sucursal con Azure), no para accesos individuales de trabajadores remotos. • DirectAccess en Windows Server 2012 es una tecnología local, no diseñada para integrarse directamente con Azure VNets. • VPN Multisite se usa para conectar múltiples redes físicas a Azure, no para usuarios remotos individuales.
  17. axyzned1 👍 1 Answered C
    A point-to-site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A point-to-site connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure virtual networks from a remote location, such as from home or a conference. Point-to-site VPN is also a useful solution to use instead of site-to-site VPN when you have only a few clients that need to connect to a virtual network. (source: https://learn.microsoft.com/en-us/azure/vpn-gateway/design#P2S)
  18. Luansi 👍 1 Answered C
    https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways For example, you can create an IPsec/IKE VPN tunnel connection between that VPN gateway and another VPN gateway (VNet-to-VNet), or create a cross-premises IPsec/IKE VPN tunnel connection between the VPN gateway and an on-premises VPN device (Site-to-Site). You can also create a Point-to-Site VPN connection (VPN over OpenVPN, IKEv2, or SSTP), which lets you connect to your virtual network from a remote location, such as from a conference or from home.
  19. kahla 👍 1 Answered C
    Point-to-Site VPN allows individual remote users to establish secure VPN connections directly to the Azure virtual network, providing them access to VMs in VNet1 without requiring on-premises VPN infrastructure. It is the most appropriate and straightforward solution for remote worker access to Azure-hosted resources.
  20. ksmani99 👍 1 Answered C
    Point-to-Site (P2S) VPN: This is specifically designed to allow individual remote clients (such as employees working from home) to connect securely to an Azure virtual network over the internet. Each remote computer initiates its own connection, functioning as a single "point" connecting to the "site" (VNet1)
  21. arjunyv2022 👍 1 Answered C
    Since remote workers need to access VMs on VNet1, the best approach is to set up a Point-to-Site (P2S) VPN. This allows individual users to connect securely to the Azure Virtual Network from anywhere using a VPN client on their device.
  22. Said Ismail 👍 1 Answered C
    A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer.
  23. Mahanad 👍 1 Answered C
    A Point-to-Site P2S VPN allows individual remote workers to securely connect their computers to an Azure virtual network over the internet.
  24. mitddgr 👍 1 Answered C
    VPN point à site (P2S) vous permet de créer une connexion sécurisée à votre réseau virtuel à partir d'un ordinateur client individuel
  25. Arkar 👍 1 Answered C
    P2S is used for Remote Access VPN on Azure by leveraging Azure Virtual Network Gateway's feature. C is correct Answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide