AZ-104 Implement and Manage Virtual Networking Practice Question
A company merged with another business, and two Azure virtual networks need to be peered for shared application access. One VNet uses 10.20.0.0/16 and the other uses 10.20.128.0/17. The administrator must make the peering work with minimal operational complexity. What should be done first?
⚠ Common exam trap
A common mix-up: candidates assume overlapping ranges can be handled with routing or network virtual appliances, but Azure VNet peering has a hard requirement for non-overlapping address spaces at creation time, and no post-peering configuration can override this.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Renumber one VNet to a non-overlapping address range before creating the peering.
Azure VNet peering requires non-overlapping address spaces. The two VNets (10.20.0.0/16 and 10.20.128.0/17) overlap because 10.20.128.0/17 is a subset of 10.20.0.0/16. Peering will fail with an error about overlapping address ranges. Renumbering one VNet to a non-overlapping range (e.g., 10.21.0.0/16) is the only way to satisfy the prerequisite for peering with minimal operational complexity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.
Why it's wrong here
Route tables do not resolve overlapping address spaces required for peering to succeed.
When this WOULD be correct
In a scenario where two VNets have overlapping address spaces but must communicate without renumbering, and a network virtual appliance (NVA) is used for traffic forwarding. Creating route tables to direct overlapping traffic to the NVA would be correct, assuming the NVA performs NAT or routing.
- ✓
Renumber one VNet to a non-overlapping address range before creating the peering.
Why this is correct
Peering requires non-overlapping CIDR ranges, so one network must be redesigned first.
- ✗
Enable gateway transit on both VNets so overlapping ranges can be routed around.
Why it's wrong here
Gateway transit helps with shared gateways, but it does not allow overlapping spaces.
When this WOULD be correct
If the VNets had non-overlapping address ranges and the goal was to enable a hub VNet to provide VPN connectivity to on-premises for a spoke VNet, enabling gateway transit on the hub and using it in the spoke would be correct.
- ✗
Create a private endpoint in each VNet for the applications that need access.
Why it's wrong here
Private endpoints connect to services, not to general VNet-to-VNet peering requirements.
When this WOULD be correct
This option would be correct in a scenario where two VNets need to securely access a shared Azure PaaS service (e.g., Azure SQL Database) without exposing it to the public internet, and the VNets have non-overlapping address ranges. The question would ask for a solution to enable private connectivity to the service from both VNets.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Renumber one VNet to a non-overlapping address range before creating the peering.Correct answer▾
Why this is correct
Peering requires non-overlapping CIDR ranges, so one network must be redesigned first.
✗Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.Wrong answer — click to see why▾
Why this is wrong here
Azure VNet peering requires non-overlapping address spaces. Overlapping ranges (10.20.0.0/16 and 10.20.128.0/17) cannot be directly peered; route tables cannot resolve the conflict because Azure peering does not support overlapping prefixes.
★ When this WOULD be the correct answer
In a scenario where two VNets have overlapping address spaces but must communicate without renumbering, and a network virtual appliance (NVA) is used for traffic forwarding. Creating route tables to direct overlapping traffic to the NVA would be correct, assuming the NVA performs NAT or routing.
Why candidates choose this
Candidates may think route tables can override peering limitations, or they confuse VNet peering with hub-and-spoke topologies where NVAs handle overlapping ranges.
✗Enable gateway transit on both VNets so overlapping ranges can be routed around.Wrong answer — click to see why▾
Why this is wrong here
Gateway transit does not resolve overlapping IP address ranges; it only allows one VNet to use the other's VPN gateway for connectivity to on-premises networks. Overlapping ranges prevent peering from being established at all.
★ When this WOULD be the correct answer
If the VNets had non-overlapping address ranges and the goal was to enable a hub VNet to provide VPN connectivity to on-premises for a spoke VNet, enabling gateway transit on the hub and using it in the spoke would be correct.
Why candidates choose this
Candidates may confuse gateway transit with a feature that can route around overlapping addresses, or think that enabling transit allows traffic to bypass the overlap via a gateway.
✗Create a private endpoint in each VNet for the applications that need access.Wrong answer — click to see why▾
Why this is wrong here
Private endpoints provide secure access to Azure PaaS services from a VNet, but they do not resolve IP address overlap between two VNets. Peering requires non-overlapping address spaces, and private endpoints cannot route traffic between overlapping ranges.
★ When this WOULD be the correct answer
This option would be correct in a scenario where two VNets need to securely access a shared Azure PaaS service (e.g., Azure SQL Database) without exposing it to the public internet, and the VNets have non-overlapping address ranges. The question would ask for a solution to enable private connectivity to the service from both VNets.
Why candidates choose this
Candidates may think private endpoints can isolate traffic and solve routing issues, or they confuse private endpoints with VNet peering as a method to connect VNets with overlapping addresses.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
VNet peering
VNet peering is a networking connection that links two virtual networks so they can communicate with each other as if they were a single network.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is building a hub-and-spoke Azure network. The hub VNet already uses 10.50.0.0/16. A new spoke VNet will later be peered to the hub and connected to on-premises through VPN. What is the most important planning step before creating the peering?
medium- A.Reuse 10.50.0.0/16 in the spoke so routing to the hub is simpler.
- ✓ B.Choose a non-overlapping address space for the spoke and reserve room for future subnets.
- C.Create a route table first so peering can learn the spoke routes.
- D.Enable a service endpoint to allow the spoke to communicate with the hub.
Why B: Azure VNet peering requires non-overlapping address spaces to establish connectivity. If the spoke uses the same address space as the hub (10.50.0.0/16), routing conflicts will occur, and the peering will fail or cause unpredictable traffic behavior. Additionally, reserving room for future subnets ensures the spoke can scale without needing to re-architect the network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.