A subnet already has a user-defined default route (0.0.0.0/0) that sends all outbound traffic to a network virtual appliance. The administrator now needs traffic to the on-premises network 10.50.0.0/16 to use the VPN gateway instead of the appliance. What should be added to the route table?

Remove the default route so the system route to the VPN gateway is used

Removing the default route would affect all non-specific destinations and is not the targeted fix.

Change the subnet address space to a smaller CIDR block

Subnet sizing does not control next-hop selection and would not change routing behavior.

Enable a service endpoint for the on-premises prefix

Service endpoints apply to Azure service access, not to routing traffic toward on-premises networks.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Add a user-defined route for 10.50.0.0/16 with next hop type Virtual network gateway — Azure chooses routes by longest prefix match, then by route source priority. A default route of 0.0.0.0/0 is broad, so a more specific 10.50.0.0/16 UDR will override it for that destination. Pointing the route to the virtual network gateway ensures on-premises traffic bypasses the NVA, while all other traffic still follows the forced-tunnel path if needed. Why others are wrong: Removing the default route would change behavior for every destination, not just on-premises traffic. Subnet resizing does not affect route selection. Service endpoints are for reaching supported Azure services securely and do not send traffic to an on-premises next hop. The key is a more specific UDR that matches the target prefix.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.