A subnet already has a 0.0.0.0/0 route that sends traffic to a virtual appliance at 10.1.1.4. One server in that subnet must reach 172.16.1.0/24 directly through the Internet, while all other traffic should still use the appliance. Which two actions are required? Select two.

Create an NSG rule that allows outbound Internet traffic.

NSGs control filtering, but they do not determine which next hop Azure chooses for the packet.

Enable a service endpoint for the Internet destination.

Service endpoints are for supported Azure services, not for routing general Internet traffic directly.

Change the subnet address space to a smaller CIDR.

Subnet size does not decide next-hop behavior when a specific UDR already matches the destination.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Add a more specific user-defined route for 172.16.1.0/24 with next hop type Internet. — Azure uses longest-prefix match when choosing routes. A /24 route to Internet overrides a broader /0 default route for only that destination, while all other traffic still follows the appliance route. The route table must also be associated with the correct subnet, otherwise the custom route is never applied. Together, these two changes create a precise exception without disturbing the rest of the subnet's forced tunneling behavior. Why others are wrong: NSG rules may still be needed for security, but they do not decide the next hop. Service endpoints are limited to supported PaaS services and do not apply to arbitrary Internet IPs. Changing the subnet size does not alter route precedence or create the exception path.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.