A subnet has a route table with a 0.0.0.0/0 user-defined route to an on-premises virtual appliance. The business now wants Azure VM outbound internet traffic to use a NAT gateway so the public source IP stays consistent, and the firewall appliance is no longer required for internet egress. What should the administrator do?

Keep the default route to the virtual appliance and add the NAT gateway to the subnet.

A user-defined default route will still take precedence for internet traffic, so the NAT gateway would not become the effective egress path.

Change the route next hop to Virtual network gateway.

A virtual network gateway is for hybrid connectivity, not internet egress through a NAT gateway, so this would not meet the requirement.

Create an NSG outbound rule that allows internet traffic from the subnet.

NSGs can allow or deny traffic, but they do not determine the public source IP used for outbound internet connections.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Remove the 0.0.0.0/0 UDR and associate the NAT gateway with the subnet. — The NAT gateway can only serve internet-bound traffic that is not already redirected by a more specific route. The existing 0.0.0.0/0 user-defined route sends all outbound traffic to the virtual appliance, so the NAT gateway never becomes the egress path. Removing that route lets Azure use the NAT gateway for internet-bound traffic and gives the VMs a consistent public source IP. Why others are wrong: A leaves the default route in place, so the firewall appliance still wins for outbound routing. C misuses the virtual network gateway next hop, which is for on-premises or cross-premises paths. D affects filtering, not source NAT selection, so it cannot provide the stable public IP the business wants.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.