AZ-104 Implement and Manage Virtual Networking Practice Question
A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a virtual appliance. Traffic to 10.20.4.12 must instead go directly to an Azure VPN gateway. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse NSG rules with routing decisions, thinking that allowing traffic in an NSG will change the path it takes, when in fact NSGs only filter traffic and do not influence the next hop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a more specific UDR for 10.20.4.0/24 that uses the virtual network gateway next hop.
User-Defined Routes (UDRs) use the longest prefix match to determine the next hop. The existing 0.0.0.0/0 route sends all outbound traffic to a virtual appliance, but adding a more specific route for 10.20.4.0/24 with a next hop of the virtual network gateway (VPN gateway) overrides the default route for that subnet, directing traffic to 10.20.4.12 through the VPN gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a network security group rule that allows traffic to 10.20.4.12.
Why it's wrong here
NSGs filter traffic, but they do not choose the next hop for routing.
When this WOULD be correct
If the question asked how to block traffic from a subnet to a specific IP address, an NSG rule with a deny action would be correct. For example, 'You need to prevent traffic from subnet A to 10.20.4.12. What should you configure?'
- ✓
Add a more specific UDR for 10.20.4.0/24 that uses the virtual network gateway next hop.
Why this is correct
Azure uses longest-prefix match, so the more specific route overrides the broader 0.0.0.0/0 entry.
- ✗
Increase the priority of the 0.0.0.0/0 route so it is preferred less often.
Why it's wrong here
Route tables do not use priority numbers; prefix length and matching determine the chosen route.
When this WOULD be correct
In a scenario where multiple UDRs exist for the same destination prefix (e.g., two routes to 10.0.0.0/16 with different next hops), increasing the priority of one route would make it preferred over another route with lower priority.
- ✗
Remove the VPN gateway association from the virtual network.
Why it's wrong here
Removing the gateway would break the desired path instead of directing only this destination correctly.
When this WOULD be correct
If the question asked to ensure that no traffic from the subnet uses the VPN gateway (e.g., for security or cost reasons), and the VPN gateway is no longer needed, then removing the association would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add a more specific UDR for 10.20.4.0/24 that uses the virtual network gateway next hop.Correct answer▾
Why this is correct
Azure uses longest-prefix match, so the more specific route overrides the broader 0.0.0.0/0 entry.
✗Add a network security group rule that allows traffic to 10.20.4.12.Wrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) rule controls inbound/outbound traffic filtering, not routing. It cannot override a user-defined route (UDR) to redirect traffic to a VPN gateway instead of a virtual appliance.
★ When this WOULD be the correct answer
If the question asked how to block traffic from a subnet to a specific IP address, an NSG rule with a deny action would be correct. For example, 'You need to prevent traffic from subnet A to 10.20.4.12. What should you configure?'
Why candidates choose this
Candidates may confuse traffic filtering (NSG) with routing (UDR), thinking that allowing traffic through an NSG can change the path traffic takes, rather than just permitting or denying it.
✗Increase the priority of the 0.0.0.0/0 route so it is preferred less often.Wrong answer — click to see why▾
Why this is wrong here
Increasing the priority of the 0.0.0.0/0 route does not change its preference; UDR priority is for routes to the same destination, and a more specific route (e.g., /24) is always preferred over a less specific one (0.0.0.0/0) regardless of priority.
★ When this WOULD be the correct answer
In a scenario where multiple UDRs exist for the same destination prefix (e.g., two routes to 10.0.0.0/16 with different next hops), increasing the priority of one route would make it preferred over another route with lower priority.
Why candidates choose this
Candidates may mistakenly think that route priority works like NSG rule priority, where higher priority numbers are evaluated first, and that increasing priority would make the 0.0.0.0/0 route less preferred.
✗Remove the VPN gateway association from the virtual network.Wrong answer — click to see why▾
Why this is wrong here
Removing the VPN gateway association would break all VPN connectivity, not just redirect traffic to 10.20.4.12. The requirement is to override the default route for a specific destination while preserving VPN gateway functionality.
★ When this WOULD be the correct answer
If the question asked to ensure that no traffic from the subnet uses the VPN gateway (e.g., for security or cost reasons), and the VPN gateway is no longer needed, then removing the association would be correct.
Why candidates choose this
Candidates may think that disassociating the VPN gateway is a simple way to stop traffic from using it, without realizing it also removes all VPN connectivity and is not a selective routing solution.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.