A security team requires all outbound traffic from a subnet to pass through an Azure Firewall at 10.1.0.4, including internet-bound traffic from the VMs. What should the administrator configure?

Assign a NAT gateway to the subnet and leave the default routing in place.

A NAT gateway helps with outbound internet source IPs, but it does not force traffic through a firewall appliance.

Enable service endpoints for the subnet so outbound traffic stays private.

Service endpoints extend private access to supported PaaS services, but they do not force all outbound traffic through a firewall appliance.

Deploy a public IP on each VM and use NSG rules to inspect the traffic.

NSGs can allow or deny traffic but cannot route all outbound traffic through a centralized security device.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet. — The requirement describes forced tunneling: all traffic, including internet-bound traffic, must go to a firewall first. In Azure, that is achieved with a user-defined route for 0.0.0.0/0 pointing to the firewall’s private IP as a virtual appliance next hop. Associating the route table with the subnet ensures every VM in that subnet uses the firewall path for outbound connections. Why others are wrong: NAT gateway is for outbound translation, not mandatory inspection through a security appliance. Service endpoints are for selected Azure services, not general egress control. Public IPs on VMs plus NSGs would distribute exposure and still would not centralize routing through the firewall. The decisive control here is the UDR.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.