Cascade Regional Airlines' compliance team requires that traffic between the headquarters data center and Azure never traverse the public internet under any circumstances. Which connectivity option meets this requirement?
Select an answer to reveal the explanation.
Short Explanation
ExpressRoute is the one option that skips the public internet entirely — it's a private, dedicated connection through a connectivity provider straight into Microsoft's network. VPN options, no matter how encrypted, are still riding the same public internet everyone else uses.
Full Explanation
ExpressRoute establishes a private connection between an on-premises network and Azure through a connectivity provider's infrastructure, and that traffic never traverses the public internet at any point, which is precisely the guarantee Cascade's compliance team is asking for. Site-to-site VPN is often mistaken for a private connection because it is encrypted, but the encryption is applied to protect data as it crosses the public internet — the underlying path is still the internet, just secured, so it does not satisfy a ‘never touches the public internet’ requirement. Point-to-site VPN has the same underlying limitation as site-to-site: client traffic is encrypted but still transits the public internet to reach the Azure VPN gateway endpoint; there is no default private-backbone routing for point-to-site connections. VNet peering connects two Azure virtual networks to each other over Microsoft's backbone, but it has no relationship to on-premises connectivity, and ‘extending it through a public IP gateway’ is not a real ExpressRoute or peering configuration. Because ExpressRoute relies on a connectivity provider and can take weeks to provision, Cascade's team should plan the ExpressRoute circuit request well ahead of any compliance deadline rather than treating it as a same-day change.