City hall needs encrypted connectivity from on-premises networks to Azure across the public internet. Which Azure networking feature matches that hybrid purpose?
Select an answer to reveal the explanation.
Short Explanation
Encrypted hybrid over the public internet is classic VPN Gateway territory — a secure tunnel to Azure. Blob tiers and availability zones are not VPN appliances. Keep hybrid encryption on the gateway story.
Full Explanation
VPN Gateway enables encrypted hybrid connectivity between on-premises networks and Azure over the public internet, typically via site-to-site IPsec/IKE tunnels and related VPN patterns. City hall that needs encrypted hybrid reachability without ordering a dedicated private circuit is in VPN Gateway territory for that describe-level purpose. Hot blob tier is about frequent object access pricing and performance, not tunnel termination for hybrid networks. Availability Zones provide datacenter-level resiliency inside a region; they do not replace VPN gateways for hybrid encryption across the internet. Table storage stores structured entities for applications; it does not terminate hybrid VPN tunnels for cities. VPN is often the first hybrid step before or alongside dedicated connectivity options. Exam caveat: VPN over the internet encrypts traffic but still rides shared internet paths—latency and bandwidth characteristics differ from dedicated ExpressRoute circuits. Operational check: deploy a VPN Gateway in a gateway subnet, establish the on-premises tunnel, verify private IP connectivity from a city-hall subnet to a test VM in Azure before migrating production hybrid flows, and record tunnel health alerts for operations staff.