AZ-104 Implement and Manage Virtual Networking Practice Question
A subnet has a route table with these user-defined routes: 10.10.0.0/16 to Virtual appliance, 10.10.5.0/24 to Virtual network gateway, and 10.10.5.128/25 to Virtual network. The subnet is attached to a VM that sends traffic to several destinations. Which three next-hop decisions are correct? Select three.
⚠ Common exam trap
Candidates often assume a broader route (like 10.10.0.0/16 to Virtual appliance) applies to all subnets, forgetting that more specific user-defined routes (like 10.10.5.0/24 to Virtual network gateway) take precedence via longest prefix match, and that public IPs like 8.8.8.8 are not matched by private address space routes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic to 10.10.5.9 uses Virtual network gateway.
The route table uses longest prefix match. The destination 10.10.5.9 falls within the 10.10.5.0/24 range, which has a more specific prefix (24 bits) than 10.10.0.0/16 (16 bits). The user-defined route for 10.10.5.0/24 specifies a next hop of Virtual network gateway, so traffic to 10.10.5.9 is forwarded to the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Traffic to 10.10.5.9 uses Virtual network gateway.
Why this is correct
Azure applies longest-prefix matching to determine the next hop for 10.10.5.9. The 10.10.5.0/24 user-defined route is a longer prefix than the broader 10.10.0.0/16 route, and the /25 route (10.10.5.128/25) does not contain this IP. Therefore, the most specific matching route directs traffic to the Virtual network gateway.
- ✓
Traffic to 10.10.5.200 uses Virtual network.
Why this is correct
For destination 10.10.5.200, Azure identifies three matching user-defined routes: 10.10.0.0/16, 10.10.5.0/24, and 10.10.5.128/25. Among these, the /25 route is the longest prefix match because 10.10.5.200 lies in the 10.10.5.128–10.10.5.255 range. Consequently, the next hop is the Virtual network, not the Virtual appliance or the Virtual network gateway.
- ✓
Traffic to 10.10.8.4 uses Virtual appliance.
Why this is correct
Traffic to 10.10.8.4 matches the 10.10.0.0/16 user-defined route because 10.10.8.4 falls within this address range. Neither 10.10.5.0/24 nor 10.10.5.128/25 matches the destination IP. Consequently, the Azure routing mechanism selects the 10.10.0.0/16 route as the longest prefix match, directing traffic to the Virtual appliance. This adheres to the longest prefix match principle for user-defined routes in the subnet's route table.
- ✗
Traffic to 10.10.5.9 uses Virtual appliance.
Why it's wrong here
The 10.10.0.0/16 user-defined route has a Virtual appliance next hop, but it is too broad to govern 10.10.5.9. Because the 10.10.5.0/24 route is a more specific prefix match for that IP, Azure always prioritizes the /24 route over the /16 route. The packet therefore goes to the Virtual network gateway, making the Virtual appliance route inapplicable for this destination.
When this WOULD be correct
If the route table did not include the 10.10.5.0/24 route, or if the Virtual appliance route had a longer prefix match (e.g., 10.10.5.0/25) that included 10.10.5.9, then traffic to 10.10.5.9 would use the Virtual appliance.
- ✗
Traffic to 8.8.8.8 uses Virtual appliance.
Why it's wrong here
8.8.8.8 is a public IP address that is not within any of the configured 10.10.x.x user-defined routes. When no UDR matches a destination, Azure falls back to system routes, and the default 0.0.0.0/0 system route sends internet-bound traffic to the Internet. A Virtual appliance would only be used for 8.8.8.8 if a separate user-defined route such as 0.0.0.0/0 were explicitly configured with that next hop.
When this WOULD be correct
If the route table included a user-defined route 0.0.0.0/0 with next hop Virtual appliance, then traffic to 8.8.8.8 would use the Virtual appliance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Traffic to 10.10.5.9 uses Virtual network gateway.Correct answer▾
Why this is correct
Azure applies longest-prefix matching to determine the next hop for 10.10.5.9. The 10.10.5.0/24 user-defined route is a longer prefix than the broader 10.10.0.0/16 route, and the /25 route (10.10.5.128/25) does not contain this IP. Therefore, the most specific matching route directs traffic to the Virtual network gateway.
✗Traffic to 10.10.5.9 uses Virtual appliance.Wrong answer — click to see why▾
Why this is wrong here
The route table has a more specific route for 10.10.5.0/24 to Virtual network gateway, which matches 10.10.5.9 exactly, so traffic uses the gateway, not the Virtual appliance.
★ When this WOULD be the correct answer
If the route table did not include the 10.10.5.0/24 route, or if the Virtual appliance route had a longer prefix match (e.g., 10.10.5.0/25) that included 10.10.5.9, then traffic to 10.10.5.9 would use the Virtual appliance.
Why candidates choose this
Candidates may mistakenly think that the Virtual appliance route (10.10.0.0/16) covers 10.10.5.9 and is the most specific, ignoring the more specific 10.10.5.0/24 route.
✗Traffic to 8.8.8.8 uses Virtual appliance.Wrong answer — click to see why▾
Why this is wrong here
The route table does not have a default route (0.0.0.0/0) pointing to the Virtual appliance; traffic to 8.8.8.8 (internet) would use the system default route (Internet) or fail if no default route exists.
★ When this WOULD be the correct answer
If the route table included a user-defined route 0.0.0.0/0 with next hop Virtual appliance, then traffic to 8.8.8.8 would use the Virtual appliance.
Why candidates choose this
Candidates may assume that a Virtual appliance can handle all non-VNet traffic, but without a default route, it won't be used for internet destinations.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
User-defined route
A user-defined route (UDR) is a custom routing rule you create in a cloud or on-premises network to override or supplement the system's default routing behavior, directing network traffic along a specific path.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A subnet has a route table with these user-defined routes: 172.16.0.0/16 -> Virtual appliance 10.1.1.4 and 172.16.1.0/24 -> Internet. A VM in the subnet sends traffic to 172.16.1.20. Which next hop is used?
medium- A.Virtual appliance 10.1.1.4, because the broader route was added first.
- ✓ B.Internet, because the most specific route prefix always wins.
- C.Virtual network gateway, because all traffic to private IP addresses uses the gateway by default.
- D.No next hop, because conflicting user-defined routes disable routing for that destination.
Why B: Azure route selection uses the longest prefix match (most specific route) to determine the next hop. The route 172.16.1.0/24 is more specific than 172.16.0.0/16, so traffic to 172.16.1.20 uses the Internet next hop, not the virtual appliance. This is consistent with how Azure evaluates user-defined routes (UDRs) and system routes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.