AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Leave the route table unchanged because the NAT gateway always overrides a default UDR.

  Why it's wrong here

  A NAT gateway does not take precedence over a user-defined route (UDR). When a subnet has a 0.0.0.0/0 UDR with a virtual appliance as the next hop, that UDR is more specific in routing priority than the system default and will steer all internet-destined traffic to the appliance, bypassing the NAT gateway entirely. To use the NAT gateway for outbound internet, the default route must be the system route (or the NAT gateway next hop), not an appliance UDR.

  When this WOULD be correct

  In a scenario where a NAT gateway is attached to a subnet and there is no UDR for 0.0.0.0/0, the NAT gateway automatically handles all outbound internet traffic without needing any route changes.

• ✓

  Remove the 0.0.0.0/0 UDR and add only the specific private-prefix routes that must go to the appliance.

  Why this is correct

  A NAT gateway provides outbound internet translation when the subnet uses the default internet route. If a 0.0.0.0/0 UDR sends traffic to an appliance, that route wins and the NAT gateway is bypassed. To meet both requirements, keep specific routes for corporate/private prefixes toward the appliance and let internet-bound traffic follow the system route, where the NAT gateway can provide stable outbound IPs.

• ✗

  Disable source NAT on the network virtual appliance.

  Why it's wrong here

  Disabling source NAT on the network virtual appliance (NVA) changes how the appliance translates packets, but it does not change Azure's routing decision to send traffic to the appliance in the first place. The 0.0.0.0/0 UDR remains in the route table, so all outbound traffic, including internet-bound traffic, continues to be directed to the NVA, and the NAT gateway never sees it. The fix is to adjust the route table, not the appliance's SNAT settings.

  When this WOULD be correct

  In a scenario where the NVA is used for outbound internet traffic but the organization wants to preserve the original source IP for logging or compliance, disabling SNAT on the NVA would be correct. For example, if the NVA must forward traffic without translating the source IP to its own.

• ✗

  Create a private endpoint for internet traffic so outbound packets stay in Azure.

  Why it's wrong here

  Private endpoints are Azure resources that provide a private IP address within a virtual network for accessing a specific PaaS service (such as Azure SQL, Storage, etc.); they have no role in general internet egress control. Creating a private endpoint for 'internet traffic' is meaningless because the internet is not a PaaS service, and private endpoints cannot override routing for all traffic. The only way to redirect outbound internet traffic to the NAT gateway is to remove the 0.0.0.0/0 UDR for the appliance.

  When this WOULD be correct

  An organization wants to securely access an Azure Storage account from on-premises without traversing the public internet. Creating a private endpoint for the storage account would be correct to route traffic through the Microsoft backbone.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question