AZ-104 Implement and Manage Virtual Networking Practice Question
A hub VNet already has a VPN gateway connected to on-premises. A new spoke VNet must reach on-premises through the hub gateway and should not deploy its own gateway. What configuration should be enabled on the peering?
⚠ Common exam trap
It's easy for candidates to confuse 'gateway transit' with simply enabling peering, forgetting that both the hub's 'Allow gateway transit' and the spoke's 'Use remote gateways' must be explicitly set, and that the spoke cannot have its own gateway (otherwise the setting is blocked).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.
Enabling 'Use remote gateways' on the spoke VNet peering and 'Allow gateway transit' on the hub VNet peering allows the spoke VNet to route traffic to on-premises through the hub's VPN gateway without deploying its own gateway. This configuration leverages BGP routes (if the VPN gateway is route-based) to propagate on-premises prefixes to the spoke, enabling transitive routing across the peering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.
Why this is correct
This is the correct hub-and-spoke configuration when only the hub should own the VPN gateway. Gateway transit allows the hub to share its gateway with peered VNets, and the spoke must be configured to use the remote gateway. Together, these settings let the spoke route on-premises traffic through the hub gateway without deploying another gateway or duplicating connectivity infrastructure.
- ✗
Create a service endpoint from the spoke to the hub.
Why it's wrong here
A service endpoint connects a subnet to specific Azure PaaS services, such as Storage or SQL Database, by routing those service destinations over the Microsoft backbone and using service tags; it is not a routing target for a VPN gateway. Creating a service endpoint from the spoke to the hub would only affect access to Azure service public IPs in that regional service, and it cannot carry VPN traffic to on-premises networks.
When this WOULD be correct
In a scenario where a spoke VNet needs secure, private access to an Azure Storage account without using a public IP, enabling a service endpoint on the spoke subnet and creating a service endpoint policy would be correct.
- ✗
Add a default route to Internet in the spoke subnet.
Why it's wrong here
Adding a 0.0.0.0/0 default route to the Internet on the spoke's subnet would force all outbound traffic to an Azure Internet next hop, bypassing the VPN gateway in the hub and making on-premises destinations unreachable. A user-defined route (UDR) should instead point on-premises traffic to the hub gateway's private IP, or better, rely on gateway transit's automatically propagated routes.
When this WOULD be correct
In a scenario where the spoke VNet needs direct Internet access without routing through the hub, and you want to ensure outbound traffic goes via the Internet (e.g., for a public-facing app), adding a default route to the Internet in the spoke subnet would be correct.
- ✗
Enable accelerated networking on the spoke subnet.
Why it's wrong here
Accelerated networking is an SR-IOV NIC feature that lowers latency and CPU overhead for individual VMs; it is enabled on a virtual network interface, not a subnet, and cannot alter inter-VNet routing or gateway sharing. Even with acceleration enabled on every spoke VM, the hub VPN gateway's routes are not propagated to the spoke, so on-premises traffic would still have no valid path.
When this WOULD be correct
A question asks how to improve network throughput and reduce latency for VMs in a spoke VNet that communicate with on-premises resources through a hub VPN gateway. Enabling accelerated networking on the spoke subnet would be correct to enhance performance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.Correct answer▾
Why this is correct
This is the correct hub-and-spoke configuration when only the hub should own the VPN gateway. Gateway transit allows the hub to share its gateway with peered VNets, and the spoke must be configured to use the remote gateway. Together, these settings let the spoke route on-premises traffic through the hub gateway without deploying another gateway or duplicating connectivity infrastructure.
✗Create a service endpoint from the spoke to the hub.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints allow private access to Azure PaaS services from a VNet, not connectivity to on-premises through a VPN gateway. They do not enable routing between VNets or to on-premises.
★ When this WOULD be the correct answer
In a scenario where a spoke VNet needs secure, private access to an Azure Storage account without using a public IP, enabling a service endpoint on the spoke subnet and creating a service endpoint policy would be correct.
Why candidates choose this
Candidates may confuse service endpoints with VPN or gateway transit, thinking they provide a path to on-premises, because both involve network connectivity and Azure services.
✗Add a default route to Internet in the spoke subnet.Wrong answer — click to see why▾
Why this is wrong here
Adding a default route to the Internet in the spoke subnet does not enable traffic to on-premises through the hub VPN gateway; it would send traffic to the Internet instead of through the hub.
★ When this WOULD be the correct answer
In a scenario where the spoke VNet needs direct Internet access without routing through the hub, and you want to ensure outbound traffic goes via the Internet (e.g., for a public-facing app), adding a default route to the Internet in the spoke subnet would be correct.
Why candidates choose this
Candidates may think a default route is needed to direct traffic to on-premises, but they overlook that the route must point to the hub gateway, not the Internet.
✗Enable accelerated networking on the spoke subnet.Wrong answer — click to see why▾
Why this is wrong here
Accelerated networking improves VM network performance via SR-IOV, but does not enable routing traffic through a hub VPN gateway. It does not affect VNet peering or gateway transit.
★ When this WOULD be the correct answer
A question asks how to improve network throughput and reduce latency for VMs in a spoke VNet that communicate with on-premises resources through a hub VPN gateway. Enabling accelerated networking on the spoke subnet would be correct to enhance performance.
Why candidates choose this
Candidates may think 'accelerated' implies faster connectivity to on-premises via the hub, confusing performance optimization with routing configuration.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet in the same region must reach on-premises networks through that existing gateway, and you do not want to deploy a separate VPN gateway in the spoke. What peering settings should you use?
medium- A.Create peering only; the spoke will automatically use the hub gateway without extra settings.
- B.Enable Use remote gateways on the hub peering and Allow gateway transit on the spoke peering.
- ✓ C.Enable Allow gateway transit on the hub peering and Use remote gateways on the spoke peering.
- D.Create a service endpoint from the spoke VNet to the on-premises network.
Why C: To enable a spoke VNet to use a hub VNet's VPN gateway for on-premises connectivity without deploying a separate gateway, you must configure the hub peering with 'Allow gateway transit' and the spoke peering with 'Use remote gateways'. This allows the spoke to route traffic through the hub's VPN gateway, leveraging the existing site-to-site VPN connection to on-premises.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.