AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure always ignores user-defined routes for storage traffic.

  Why it's wrong here

  Azure does not unconditionally ignore user-defined routes for storage traffic; the routing decision is prefix-based and depends on what other routes exist. While Microsoft's recommended design is to use service endpoints or private endpoints for controlled access to Storage, a UDR with a specific address prefix for the storage account's public IP can absolutely override the system route. The claim of 'always' is false because route selection follows longest-prefix match, and a custom route can win over the default 0.0.0.0/0. However, storage traffic over the Azure backbone may be affected by inherent platform routing, so the actual path depends on the effective route table.

  When this WOULD be correct

  In a scenario where a question states that Azure Storage traffic must always use the Microsoft backbone network and cannot be forced through a network virtual appliance, this option would be correct if the question explicitly says Azure ignores UDRs for storage traffic due to a service-specific route that cannot be overridden.

• ✓

  The storage account traffic is using a more specific route than the 0.0.0.0/0 route.

  Why this is correct

  Route selection prefers the most specific matching prefix. If a more specific route exists for the storage destination, it can win over the default route to the NVA. This is why forced tunneling designs must be checked against specific system or learned routes. Understanding route precedence is essential when traffic does not follow the default next hop that appears to be in place.

• ✗

  NSG outbound rules override user-defined routes in Azure.

  Why it's wrong here

  Network security groups enforce allow or deny decisions on traffic at the network interface or subnet, but they do not influence next-hop selection. A UDR, on the other hand, is a routing construct that tells the Azure platform which virtual appliance or custom gateway should receive traffic destined for a given prefix. NSGs can block traffic that the UDR would route, but they cannot change the route itself; they are a filter, not a route override. Therefore, outbound NSG rules do not work as a higher-priority mechanism than user-defined routes.

  When this WOULD be correct

  In a scenario where a VM cannot reach the internet despite having a default route via an NVA, and the NVA is correctly configured, an NSG outbound rule blocking traffic (e.g., deny all outbound) could be the cause. The question would specify that routing is correct but connectivity fails.

• ✗

  The subnet needs a public IP address assigned to each VM for the route to take effect.

  Why it's wrong here

  A user-defined route does not depend on a VM having a public IP address. UDRs in Azure direct traffic at Layer 3 based on destination prefix, regardless of whether the source or destination has a public IP. Even VMs in a subnet with no public IPs will apply the effective route table to private traffic, so the absence of public IPs cannot prevent the 0.0.0.0/0 route from taking effect. Thus this statement is incorrect.

  When this WOULD be correct

  If the question asked why a VM cannot initiate outbound internet traffic despite having a default route, and the VM lacked a public IP or NAT configuration, then assigning a public IP would be necessary for outbound connectivity.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question