AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

  Why it's wrong here

  This option misreads the UDR as a blanket override for all traffic in the 10.0.0.0/8 range. Azure selects routes by longest-prefix match first: the peered VNet's system route to 10.12.0.0/16 is more specific than the UDR's 10.0.0.0/8, so packets to 10.12.4.25 are sent via VNet peering. A UDR only overrides a system route when its prefix length is equal to or more specific than the competing route; a broader UDR cannot win.

  When this WOULD be correct

  If the UDR had a more specific prefix (e.g., 10.12.0.0/16) or if the traffic was destined to an IP within the UDR's range but not covered by a more specific route (e.g., 10.0.0.1), then the virtual appliance would be the next hop.

• ✗

  Internet, because traffic not explicitly matched by the UDR leaves through the default route.

  Why it's wrong here

  The default route (0.0.0.0/0) is the least-specific route in the effective route table and is used only when no other route matches the destination. For 10.12.4.25, both the UDR 10.0.0.0/8 and the peering route 10.12.0.0/16 match, and the most specific of those is the /16 peering route. Therefore the packet is forwarded to the peered VNet, not to the Internet, because a more specific valid route exists and the default route is never selected when a more specific match is present.

  When this WOULD be correct

  If the subnet had no UDR and no VNet peering, and the VM sent traffic to an IP not matching any VNet or peering route, Azure would use the default system route (0.0.0.0/0, next hop Internet) for internet-bound traffic.

• ✗

  None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

  Why it's wrong here

  A UDR on a subnet does not disable or block VNet peering. Azure combines system routes, BGP routes, and user-defined routes into an effective route table for each subnet, and then applies longest-prefix match to choose among all applicable routes. Here, the peering route to 10.12.0.0/16 and the UDR to 10.0.0.0/8 both exist; the more specific peering route is selected, so routing still succeeds. If the UDR had the same or a more specific prefix than the peering route, it could override peering, but that is not the case in this scenario.

  When this WOULD be correct

  If the UDR had a more specific route (e.g., 10.12.0.0/16) with next hop Virtual appliance, and the VNet peering was not configured to use the remote gateway or had a conflicting route, then Azure would use the UDR and traffic would not reach the peered VNet directly.

• ✓

  VNet peering, because the peered VNet prefix is more specific than the broader UDR.

  Why this is correct

  Azure uses longest-prefix match first. The peered VNet has a /16 route to 10.12.4.25, while the UDR only matches 10.0.0.0/8. The /16 system route is more specific, so the packet follows VNet peering rather than the virtual appliance. This is a common design trap when administrators expect every UDR to override all other routes.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question