Express route: dedicated and/or private

To my understanding, Expressroute provides a DEDICATED connection via a partner provider to the Azure cloud; avoiding the public internet. 

Now from what I understand (please someone correct me); this connection is dedicated but not actually private.

It private because it avoid the public internet, but not private as far if the connection was intercepted, data by default is not encrypted?

So for it to be a private connection as well as dedicated, you need to establish a VPN tunnel(or related privacy enabled configuration) between your on premise and azure hosted service/resource/vnet/etc.

Is this correct, or is the connection from on premise to the azure platform via expressroute, is automatically encrypted end to end? but not once into the azure platform itself?

At what pointy if any, is express route not private (encrypted)?

I'm studying for az104, and I'm trying to get a solid answer, if by default, is express route, dedicated and private; encrypted not just "private by avoiding the public internet". the latter is not truly private, its just segregated from public traffic.