A company wants to connect its on-premises datacenter to an Azure virtual network. They need an encrypted connection that travels over the public internet, and they do not require a dedicated private circuit or the higher bandwidth guarantees that come with one. Which Azure service should they use?