AZ-104 Implement and Manage Storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable forwarded traffic on both peerings and disable gateway transit.

  Why it's wrong here

  Enabling forwarded traffic on both peerings only permits the hub to forward packets that did not originate within the peered networks—this is intended for traffic transiting a network virtual appliance (NVA). It does not, by itself, allow the spoke to use the hub's VPN gateway for on-premises connectivity. Gateway transit is a distinct peering property: the hub peering must allow gateway transit and the spoke peering must use the remote gateway. Disabling gateway transit explicitly blocks the propagation of on-premises routes from the hub gateway into the spoke's effective route table, so the spoke will never learn routes to on-premises through this path.

  When this WOULD be correct

  This option would be correct in a scenario where the spoke VNet needs to forward traffic to the hub for inspection (e.g., via a network virtual appliance) but the hub does not provide gateway transit; instead, the spoke has its own VPN gateway for on-premises access.

• ✓

  Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.

  Why this is correct

  This is the correct hub-and-spoke gateway sharing configuration. The hub peering must allow gateway transit, and the spoke peering must use the remote gateway in the hub. Together, these settings let the spoke route on-premises traffic through the hub VPN gateway without deploying a second gateway.

• ✗

  Create a second VPN gateway in the spoke and peer the two gateways.

  Why it's wrong here

  Deploying a second VPN gateway in the spoke and attempting to peer the gateways is an anti-pattern. Azure virtual network peering connects virtual networks, not VPN gateways; VPN gateways cannot be directly peered to each other. This approach duplicates the gateway cost, introduces additional IPsec tunnel management, and requires separate BGP configurations, whereas the hub-and-spoke design already supports gateway transit through peering. The correct configuration uses the hub's existing VPN gateway as the shared egress/ingress point, so a second gateway is unnecessary and will incorrectly try to establish an on-premises connection from the spoke instead of leveraging the hub's already-established connectivity.

  When this WOULD be correct

  This option would be correct if the question required high availability or isolation, such as when the spoke must have its own direct VPN connection to on-premises for redundancy or compliance, independent of the hub.

• ✗

  Configure the spoke subnet with a service endpoint to the hub gateway subnet.

  Why it's wrong here

  Configuring a service endpoint on the spoke subnet to the hub gateway subnet is fundamentally misapplied. Service endpoints provide private, direct connectivity to Azure PaaS services (such as Azure Storage or SQL Database) over the Microsoft backbone; they are not a routing mechanism for network gateways. The hub gateway subnet is a network resource, not a PaaS service, and service endpoints cannot be used to influence the path toward on-premises networks. This action would have no effect on the spoke's ability to reach on-premises systems through the hub VPN gateway, nor would it modify the effective routes in the spoke subnet.

  When this WOULD be correct

  This option would be correct in a scenario where a subnet in a spoke VNet needs to securely access an Azure PaaS service (like Azure Storage or SQL Database) without using a public IP, by routing traffic through the hub's service endpoint.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question