AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Keep the default route and add a second NAT gateway to the subnet.

  Why it's wrong here

  Azure does not allow multiple NAT gateways to be attached to the same subnet, so adding a second NAT gateway is not a valid configuration. Even if it were permitted, the existing 0.0.0.0/0 UDR pointing to a virtual appliance would still take precedence over the NAT gateway's system route, so outbound internet traffic would continue to bypass the NAT service. Removing or overriding that default route is the only way to restore NAT gateway operation.

  When this WOULD be correct

  In a scenario where a subnet already uses a NAT gateway for internet traffic but needs additional outbound capacity or redundancy, adding a second NAT gateway to the subnet (with proper routing) could distribute traffic. The question would not involve a conflicting UDR for 0.0.0.0/0.

• ✓

  Remove the 0.0.0.0/0 user-defined route and keep only specific routes for private prefixes.

  Why this is correct

  A subnet-level 0.0.0.0/0 UDR to a virtual appliance overrides the system route that would otherwise let the NAT gateway handle internet-bound traffic. Removing that default route restores normal outbound internet handling through the NAT gateway, while more specific routes for on-premises or private destinations can remain in place. This preserves both functionality and control.

• ✗

  Disable network security groups on the subnet so the NAT gateway becomes active.

  Why it's wrong here

  Network security groups (NSGs) filter traffic based on security rules at layers 3 and 4, but they do not participate in route selection or next-hop determination. A NAT gateway becomes active only when the effective route for 0.0.0.0/0 points to the NAT service; NSG settings have no effect on that system route or its precedence over a UDR. Disabling NSGs would remove a critical security boundary without resolving the conflicting default route, so outbound internet traffic would still be sent to the virtual appliance instead of the NAT gateway.

  When this WOULD be correct

  If a subnet has a NAT gateway but outbound traffic is blocked by NSG rules (e.g., default deny outbound), disabling NSGs would allow the NAT gateway to route traffic outbound. This would be correct when the issue is NSG filtering, not routing.

• ✗

  Set gateway route propagation to Disabled so the NAT gateway is preferred.

  Why it's wrong here

  Gateway route propagation controls whether BGP-learned routes from a virtual network gateway are added to the subnet's effective route table; it does not influence the priority of user-defined routes. Disabling propagation only prevents dynamic on-premises or regional routes from being injected, leaving the 0.0.0.0/0 UDR to the virtual appliance untouched and still highest-priority. Since a NAT gateway's default route is a system route with lower precedence than any UDR, disabling propagation cannot make the NAT gateway the preferred next hop for internet-bound traffic.

  When this WOULD be correct

  In a scenario where a subnet has forced tunneling enabled (e.g., via VPN gateway) and you want to allow direct internet access from the subnet, you would disable gateway route propagation to prevent the forced tunneling route from overriding the NAT gateway's default route.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question