The AZ-700 exam asks which scenario calls for a dedicated private circuit and when a global hub topology is the better fit. ExpressRoute creates a path between on-premises and Azure that never touches the public internet, while Virtual WAN is a hub platform that consolidates dozens of branches, VNets, and partner connections under a single management plane.
ExpressRoute: A Dedicated High-Speed Rail Line
Think of traveling between two major cities. You can drive on the public highway, which everyone shares and which slows to a crawl during peak hours, or you can take a dedicated high-speed rail line that runs on its own track unaffected by road congestion. ExpressRoute plays the role of that dedicated rail line between your on-premises datacenter and Azure.
With ExpressRoute, traffic never traverses the public internet. It connects directly to the Microsoft backbone through a connectivity provider's physical circuit or via ExpressRoute Direct at 10 Gbps or 100 Gbps. The result is stable latency, guaranteed SLA, and a connectivity model that satisfies strict compliance and security requirements.
Once you create an ExpressRoute Circuit in the Azure Portal, a Service key is issued. You hand that key to your connectivity provider, who completes the physical provisioning. After that, you configure Peering and create a Connection between the Circuit and your Virtual Network Gateway before on-premises traffic can reach resources inside a VNet.
Private Peering and Microsoft Peering
Airports have separate gates for domestic and international passengers. ExpressRoute separates traffic by destination in the same way. Private Peering routes traffic to private IP addresses inside a VNet, while Microsoft Peering routes traffic to public endpoints like Azure Storage, Azure SQL, and Microsoft 365.
With Private Peering, on-premises servers talk directly to VM private IPs without any public internet hop, making Azure IaaS resources feel like an extension of the local network. Microsoft Peering advertises Microsoft's public IP ranges via BGP to on-premises routers, so traffic to Microsoft 365 or Azure Blob Storage travels the ExpressRoute circuit instead of the internet. Route filters let you accept only the BGP communities for services you need. Both Peering types can be active on the same Circuit. If the exam offers 'Public Peering', it is a wrong answer — new configurations are no longer available.
SKU Tiers: Local, Standard, and Premium
Hotel tiers change your amenities and reach. ExpressRoute SKUs work the same way.
SKU limits connectivity to Azure regions in the same metro as the peering location and carries no egress data transfer charges — ideal for bulk data transfers to a nearby region.
SKU reaches all Azure regions within the same geopolitical boundary. The route advertisement limit is 4,000 prefixes.
SKU removes geopolitical limits, connecting a single Circuit to Azure regions worldwide with a route limit of 10,000 prefixes. Global Reach also becomes available: it links two Premium ExpressRoute Circuits in different geopolitical regions through the Microsoft backbone so that two on-premises sites can communicate via Azure.
!ExpressRoute SKU tiers
FastPath: The Direct Lane That Skips the Tollbooth
Some airports have a fast-track lane at security that experienced frequent fliers can use, bypassing the regular queue. FastPath works the same way for ExpressRoute data traffic. Normally all packets pass through the ExpressRoute Gateway on their way into a VNet, but at high bandwidths the gateway can become a bottleneck.
When FastPath is enabled, the data plane bypasses the gateway and delivers packets directly to the VM's network interface. The gateway still handles the control plane — BGP route exchange — but actual data packets skip it entirely. FastPath requires an Ultra Performance or ErGw3AZ Gateway SKU and is not supported for resources in peered VNets reachable via VNet Peering.
Virtual WAN: A Global Hub Airport Network
Picture an airline network where every city connects directly to every other — route management explodes. Hub airports simplify this by centralizing connections. Virtual WAN applies the same logic to Azure networking.
Virtual WAN deploys managed Virtual Hubs in Azure regions and automatically connects branches, VNets, ExpressRoute circuits, VPN sites, and SD-WAN partners to those hubs. The Microsoft backbone provides automatic mesh routing between hubs, so Branch-to-Branch traffic flows without extra configuration.
type supports only Site-to-Site VPN. type adds ExpressRoute, Point-to-Site VPN, SD-WAN partners, and inter-hub connectivity. When the exam integrates ExpressRoute with Virtual WAN, Standard type is the answer.
Secured Virtual Hub and Hub Routing Intent
If a standard Virtual Hub is a plain airport, a Secured Virtual Hub is an airport where the security checkpoint is built into the center of every terminal. Azure Firewall is integrated directly inside the Virtual Hub, inspecting all traffic that passes through it according to firewall policies.
Hub Routing Intent is the policy that tells a Secured Virtual Hub to force internet-bound or private traffic through Azure Firewall or a third-party NVA. When the internet traffic policy is turned on, all egress internet traffic from spokes connected to the hub flows through the firewall. When the private traffic policy is turned on, Branch-to-VNet and VNet-to-VNet traffic also passes through firewall inspection before being forwarded.
Choosing Between ExpressRoute, VPN, and Virtual WAN
Ordering from a menu depends on your budget, group size, and occasion. Hybrid connectivity decisions follow the same logic — the right choice depends on requirements.
| Criteria | Site-to-Site VPN | ExpressRoute | Virtual WAN | |:--|:--|:--|:--| | Path | Internet (encrypted) | Dedicated circuit | Internet/dedicated (hub-centric) | | Bandwidth | ~1.25 Gbps | Up to 100 Gbps | Aggregated per hub | | Latency | Variable | Stable, predictable | Varies by path | | Scale | Few sites | Few to medium | Dozens of sites | | Cost | Low | High | Medium to high | | Primary reason | Fast setup, low cost | SLA, compliance, high bandwidth | Global branch consolidation |
Choose ExpressRoute when compliance mandates or predictable latency is non-negotiable, Virtual WAN when you need to unify dozens of branches under a single management plane, and Site-to-Site VPN when you need a quick, low-cost connection for a small number of sites.
Exam Key Takeaways
"On-premises to Azure, no public internet, dedicated circuit" -- ExpressRoute "Direct communication to VM private IPs inside a VNet" -- Private Peering "Microsoft 365 and Azure Storage over a dedicated circuit" -- Microsoft Peering "Public Peering" -- no longer configurable, wrong answer "Single Circuit connecting to all Azure regions worldwide" -- Premium SKU "Two on-premises sites connected through the Microsoft backbone" -- Global Reach (requires Premium) "Gateway bypass, data plane delivered directly to VMs" -- FastPath (Ultra Performance / ErGw3AZ) "Local SKU advantage" -- no egress charges, same-metro region only "Hub-centric auto-mesh for dozens of branches and VNets" -- Virtual WAN "Hub integrating ExpressRoute, VPN, and SD-WAN partners" -- Virtual WAN Standard type "Azure Firewall embedded inside a Virtual Hub" -- Secured Virtual Hub "Policy to force internet or private traffic through the firewall" -- Hub Routing Intent
ExpressRoute = dedicated private circuit with no internet hops, Virtual WAN = global hub-and-spoke automation platform