DRAG DROP
You plan to connect a customer’s on-premises infrastructure to Azure. You have several connections available.
You have the following requirements:
All connections must be secure.
All on-premises solutions must support hybrid functionality.
You need to recommend connectivity solutions.
Which solutions should you recommend? To answer, drag the appropriate connection strategy to the correct
connection. Each connection strategy may be used once, more than once, or not at all. You may need to drag
the split bar between panes or scroll to view content.
Select and Place:
Answer: 
Wrong , ExpressRoute connections do not go over the public Internet, also it supports IPSEC.
Right Answers :
S2S VPN > Existing WAN network
P2S VPN > Windows Built-in VPN
Express Route > IPSEC VPN
No given answer is correct
https://azure.microsoft.com/en-us/blog/expressroute-or-virtual-network-vpn-whats-right-for-me/