AZ-104 Implement and Manage Virtual Networking Practice Question
A security team requires all outbound traffic from a subnet to pass through an Azure Firewall at 10.1.0.4, including internet-bound traffic from the VMs. What should the administrator configure?
⚠ Common exam trap
Many exam-takers confuse NAT gateways or service endpoints as solutions for routing traffic through a firewall, but neither provides the forced routing and inspection required; only a UDR with a default route to the firewall's private IP achieves this.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.
Creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP (10.1.0.4) and associating it with the subnet forces all outbound traffic, including internet-bound traffic, to be routed through the firewall. This ensures the firewall can inspect and control all egress traffic as required by the security team.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a NAT gateway to the subnet and leave the default routing in place.
Why it's wrong here
A NAT gateway provides source network address translation so that outbound traffic appears to come from a static public IP, but it does not inspect or modify the traffic path. With the default route 0.0.0.0/0 still pointing to the internet, NAT simply changes the source IP, allowing traffic to bypass any centralized firewall inspection. To achieve forced tunneling, you must replace the default route with a user-defined route that points to the firewall's private IP as the next hop.
When this WOULD be correct
A NAT gateway would be correct if the requirement is simply to provide outbound internet connectivity to VMs in a private subnet without needing traffic inspection or forced tunneling. For example, 'VMs in a subnet need to access the internet but must not be directly reachable from the internet; no firewall inspection is required.'
- ✓
Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.
Why this is correct
Forced tunneling is implemented with a user-defined route that sends the default route to a virtual appliance. By creating a 0.0.0.0/0 UDR that points to the Azure Firewall’s private IP and associating that route table with the subnet, all outbound traffic is steered through the firewall. This is the standard design when the firewall must inspect internet-bound traffic.
- ✗
Enable service endpoints for the subnet so outbound traffic stays private.
Why it's wrong here
Service endpoints extend the VNet's private address space to specific PaaS services like Azure Storage or SQL Database, overriding routing for only those service IP ranges. They do not create a default route to the firewall appliance, nor do they redirect or inspect general internet-bound traffic. Since service endpoints only apply to supported Azure services and not to all outbound traffic, they cannot force all traffic through a centralized security device.
When this WOULD be correct
When the requirement is to ensure that traffic to a specific Azure service (e.g., Azure Storage or SQL Database) stays within the Azure backbone and does not go over the internet, enabling service endpoints on the subnet would be correct.
- ✗
Deploy a public IP on each VM and use NSG rules to inspect the traffic.
Why it's wrong here
Assigning a public IP to each VM creates a direct path to the internet, but NSG rules are not routing constructs and cannot redirect traffic to a next hop. NSGs are stateful access-control lists that filter traffic at the network interface or subnet level—they can allow or deny but do not perform deep packet inspection or forward traffic through a firewall appliance. Thus, this approach leaves the default internet route unchanged and fails to force traffic through a security appliance.
When this WOULD be correct
This would be correct if the requirement was to allow each VM to have its own public IP for direct outbound internet access, with NSG rules controlling inbound/outbound traffic at the network level, without a central firewall.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.Correct answer▾
Why this is correct
Forced tunneling is implemented with a user-defined route that sends the default route to a virtual appliance. By creating a 0.0.0.0/0 UDR that points to the Azure Firewall’s private IP and associating that route table with the subnet, all outbound traffic is steered through the firewall. This is the standard design when the firewall must inspect internet-bound traffic.
✗Assign a NAT gateway to the subnet and leave the default routing in place.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet access with source network address translation (SNAT), but it does not route traffic through the Azure Firewall at 10.1.0.4. The requirement is to force all outbound traffic via the firewall for inspection, which requires a custom route (UDR) pointing to the firewall's private IP.
★ When this WOULD be the correct answer
A NAT gateway would be correct if the requirement is simply to provide outbound internet connectivity to VMs in a private subnet without needing traffic inspection or forced tunneling. For example, 'VMs in a subnet need to access the internet but must not be directly reachable from the internet; no firewall inspection is required.'
Why candidates choose this
Candidates may confuse NAT gateway with a firewall, thinking it can also inspect traffic, or they may assume that default routing plus NAT is sufficient for outbound traffic, overlooking the explicit requirement to route through the firewall.
✗Enable service endpoints for the subnet so outbound traffic stays private.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints do not route traffic through a firewall; they allow direct private access to Azure services, bypassing the firewall. This would not force all outbound traffic through the Azure Firewall at 10.1.0.4.
★ When this WOULD be the correct answer
When the requirement is to ensure that traffic to a specific Azure service (e.g., Azure Storage or SQL Database) stays within the Azure backbone and does not go over the internet, enabling service endpoints on the subnet would be correct.
Why candidates choose this
Candidates may confuse service endpoints with forcing traffic through a firewall, thinking that 'keeping traffic private' implies routing through a security appliance, but service endpoints actually bypass the firewall.
✗Deploy a public IP on each VM and use NSG rules to inspect the traffic.Wrong answer — click to see why▾
Why this is wrong here
This option does not route traffic through the Azure Firewall; instead, it allows VMs to directly access the internet via their public IPs, bypassing the firewall and failing the requirement.
★ When this WOULD be the correct answer
This would be correct if the requirement was to allow each VM to have its own public IP for direct outbound internet access, with NSG rules controlling inbound/outbound traffic at the network level, without a central firewall.
Why candidates choose this
Candidates may think assigning public IPs and using NSGs provides similar security, but they overlook the need for centralized inspection and routing through the firewall.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.