A subnet has a user-defined route for 10.0.0.0/8 with next hop Virtual appliance 10.1.1.4. The VNet is peered with VNet-Shared, whose address space is 10.12.0.0/16. A VM in the subnet sends traffic to 10.12.4.25. Which next hop will Azure use?

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

The UDR is broader, but a more specific system route to the peered VNet can take precedence.

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

This destination is explicitly covered by a more specific peering route, so Internet is not chosen.

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

UDRs and peering can coexist, and Azure still selects the most specific valid route.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: VNet peering, because the peered VNet prefix is more specific than the broader UDR. — Azure route selection starts with the most specific prefix, not simply the route table entry you remember most. Even though the subnet has a UDR for the larger 10.0.0.0/8 range, the destination 10.12.4.25 matches the peered VNet’s more specific /16 route. Therefore, Azure sends the traffic across the VNet peering path instead of to the NVA. This behavior is central to troubleshooting asymmetric routing and unexpected next hops. Why others are wrong: The virtual appliance route is too broad to win against a more specific peered VNet route. The Internet is only used when no better matching route exists, which is not the case here. Azure absolutely can route to peered VNets while UDRs exist; it simply chooses the most specific applicable route. The key concept is route specificity, not the existence of any UDR at all.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.