A service that creates encrypted connections between Azure networks (VNets) and on-premises networks, or between VNets. It uses IPsec/IKE protocols to build site-to-site or point-to-site VPNs.
Used for hybrid connectivity in AZ-104 and AZ-900. A cheaper alternative to ExpressRoute, but with lower bandwidth and no dedicated-connection SLA. Question: secure but low-cost Azure-to-on-premises connectivity → VPN Gateway.
Azure VPN Gateway is a concept that can show up on the exam. Check the full guide to see it in context.