A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?

Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.

This forces all traffic to the VPN gateway and is the opposite of the stated internet-routing requirement.

Create a service endpoint for the subnet and use it as the default next hop.

Service endpoints are for Azure PaaS services, not for general routing to the internet or on-premises prefixes.

Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.

NSGs do not choose next hops, so they cannot replace route-table design for this scenario.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled. — The clean design is to route only the specific on-premises prefixes through the VPN gateway and leave the default route intact. That way, Azure handles internet-bound traffic through the normal system path, while private destinations use the explicit routes. This avoids forced tunneling, preserves gateway reachability, and keeps the configuration aligned to the requirement. Why others are wrong: A default 0.0.0.0/0 route to the VPN gateway would force all traffic, which is not desired. Service endpoints are unrelated to general routing. NSGs can permit or deny traffic, but they do not determine the path traffic takes to a destination.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.