AZ-104 Implement and Manage Virtual Networking Practice Question
A company has an Azure virtual network named HubVNet with a VPN gateway that connects to on-premises. A spoke virtual network named SpokeVNet is peered to HubVNet, and you need VMs in SpokeVNet to reach on-premises resources through the hub VPN gateway. The on-premises network uses 192.168.0.0/16. After configuring the peering, spoke VMs cannot reach on-premises hosts. What should you configure?
⚠ Common exam trap
The trap here is creating a user-defined route with next hop Virtual network gateway in the spoke, which is invalid because the spoke does not host a gateway of its own.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Use remote gateways on the SpokeVNet-to-HubVNet peering and Allow gateway transit on the HubVNet-to-SpokeVNet peering.
Gateway transit lets a peered spoke virtual network use the hub's VPN gateway for on-premises connectivity. The hub-to-spoke peering must have Allow gateway transit enabled, and the spoke-to-hub peering must have Use remote gateways enabled. Both settings together allow the spoke to learn on-premises routes and reach 192.168.0.0/16.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Use remote gateways on the SpokeVNet-to-HubVNet peering and Allow gateway transit on the HubVNet-to-SpokeVNet peering.
Why this is correct
To let a spoke use the hub's VPN gateway, the spoke-to-hub peering must have Use remote gateways enabled, and the hub-to-spoke peering must have Allow gateway transit enabled. These settings allow the spoke to learn on-premises routes through the hub gateway. Without both settings, the spoke has no route to 192.168.0.0/16 and traffic cannot reach on-premises.
- ✗
Create a user-defined route in SpokeVNet for 192.168.0.0/16 with next hop type Virtual network gateway.
Why it's wrong here
A user-defined route with next hop Virtual network gateway is only valid for gateways in the same virtual network. SpokeVNet does not have its own gateway, so the route cannot point to a gateway it does not contain. The correct approach is to use peering gateway transit settings so the spoke learns routes dynamically from the hub gateway.
- ✗
Deploy a second VPN gateway in SpokeVNet and create a site-to-site connection to the on-premises VPN device.
Why it's wrong here
Deploying another VPN gateway in the spoke adds cost and complexity and creates a separate connection to on-premises, which is unnecessary when the hub gateway can be shared through peering. It also requires additional public IPs and on-premises configuration. Gateway transit is the intended design for sharing a single gateway across peered virtual networks.
- ✗
Add a route for 192.168.0.0/16 in the HubVNet gateway subnet with next hop type Virtual network gateway.
Why it's wrong here
The hub gateway already learns on-premises routes through BGP or static configuration, and adding a route in the gateway subnet does not propagate to the spoke. The problem is that the spoke has no gateway and no learned routes. Enabling gateway transit on the peering is what allows the spoke to use the hub gateway and receive the on-premises routes.
Go deeper
Related to this question
Learn chapter
Azure Dedicated Hosts
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,053 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.