A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?

Azure always ignores user-defined routes for storage traffic.

Azure does not universally ignore user-defined routes for storage; route selection depends on prefixes and the destination path.

NSG outbound rules override user-defined routes in Azure.

NSGs filter traffic but do not determine next hop, so they do not override routing decisions.

The subnet needs a public IP address assigned to each VM for the route to take effect.

Public IPs are not required for UDRs. Routing applies to private IP traffic inside Azure networking as well.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: The storage account traffic is using a more specific route than the 0.0.0.0/0 route. — Azure uses longest-prefix match when choosing a route. A default route such as 0.0.0.0/0 is less specific than a route that matches a smaller destination prefix, so traffic to some Azure services may follow a more specific path instead of the NVA. In forced-tunneling designs, administrators should review effective routes and any service-specific or learned routes to confirm the actual next hop for the traffic they care about. Why others are wrong: A is incorrect because Azure does honor UDRs; the issue is usually route specificity, not route ignorance. C confuses security filtering with routing. D is irrelevant because UDRs work independently of whether a VM has a public IP.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.