CV0-004 Operations and Support Practice Question
A cloud administrator is responsible for a Microsoft Azure environment with a hub-and-spoke network topology. The administrator needs to ensure that all traffic from the spoke virtual networks to the internet is routed through a network virtual appliance (NVA) in the hub virtual network for inspection. Which Azure feature should the administrator configure?
⚠ Common exam trap
The trap here is assuming that virtual network peering or Azure Firewall automatically routes traffic through an NVA, when in fact user-defined routes are required to override default routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User-defined routes (UDRs) on the spoke subnets pointing to the NVA's private IP address
To force traffic from spoke virtual networks through a network virtual appliance in the hub, the administrator must configure user-defined routes on the spoke subnets. The UDR sets the next hop type to 'Virtual appliance' and specifies the NVA's private IP address. This overrides Azure's default system routes and ensures traffic is sent to the NVA for inspection before reaching the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Private Link to connect the spokes to the hub
Why it's wrong here
Azure Private Link provides private connectivity to Azure services over a private endpoint, keeping traffic on the Microsoft backbone network. It is not used to route traffic through an NVA for inspection. It does not control routing between virtual networks or to the internet. Therefore, it does not meet the requirement to force spoke internet traffic through the NVA in the hub.
- ✗
Virtual network peering with gateway transit enabled
Why it's wrong here
Virtual network peering connects virtual networks, and gateway transit allows spokes to use the hub's VPN or ExpressRoute gateway. However, peering alone does not force traffic through an NVA. By default, peered networks can communicate directly. To route through an NVA, user-defined routes are required. Gateway transit is about sharing a gateway, not about NVA inspection, so it does not meet the scenario's requirement.
- ✓
User-defined routes (UDRs) on the spoke subnets pointing to the NVA's private IP address
Why this is correct
User-defined routes allow the administrator to override Azure's default system routes. By creating a UDR on the spoke subnets with the next hop type set to 'Virtual appliance' and specifying the NVA's private IP address, all traffic destined for the internet or other networks can be forced through the NVA for inspection. This directly satisfies the requirement to route spoke traffic through the NVA in the hub.
- ✗
Azure Firewall in the hub virtual network with forced tunneling
Why it's wrong here
Azure Firewall is a managed, cloud-native firewall service, but it is not an NVA. The scenario specifically requires routing traffic through a network virtual appliance for inspection. While Azure Firewall can inspect traffic, it does not meet the requirement of using an NVA. Forced tunneling is also typically used to route traffic to on-premises, not to an NVA in a hub virtual network.
Visual reference
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.