- A
Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled.
This lets the subnet use specific routes for on-premises destinations through the VPN gateway while leaving the default internet route untouched. Because there is no 0.0.0.0/0 UDR, Azure can use the normal system route for internet traffic. Keeping gateway route propagation enabled also allows learned gateway routes to appear when appropriate.
- B
Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.
Why wrong: This forces all traffic to the VPN gateway and is the opposite of the stated internet-routing requirement.
- C
Create a service endpoint for the subnet and use it as the default next hop.
Why wrong: Service endpoints are for Azure PaaS services, not for general routing to the internet or on-premises prefixes.
- D
Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.
Why wrong: NSGs do not choose next hops, so they cannot replace route-table design for this scenario.
Quick Answer
The correct design is to associate a route table containing only the specific on-premises prefixes while leaving gateway route propagation enabled. This works because the user-defined routes (UDRs) for the on-premises networks override the default system routes for those destinations, directing traffic through the VPN gateway, while the absence of a 0.0.0.0/0 UDR allows Azure’s default system route for internet-bound traffic to remain in effect. On the AZ-104 exam, this scenario tests your understanding of how gateway route propagation interacts with custom routes—a common trap is assuming that enabling propagation automatically adds a learned 0.0.0.0/0 route to the subnet, but in reality, propagation only adds routes learned from the gateway via BGP, and without a matching UDR, the default Azure internet path is preserved. A helpful memory tip: “Specific routes for the gateway, let Azure handle the rest—no forced tunnel, no default UDR.”
AZ-104 Implement and Manage Virtual Networking Practice Question
This AZ-104 practice question tests your understanding of implement and manage virtual networking. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled.
Option A is correct because it uses a route table with only the specific on-premises prefixes, which forces traffic destined for those prefixes through the VPN gateway, while leaving gateway route propagation enabled. With gateway propagation enabled, the VPN gateway's learned routes (including the 0.0.0.0/0 route from the on-premises network) are not automatically added to the subnet's route table unless explicitly propagated; instead, the subnet's effective routes combine the user-defined routes (UDRs) for on-premises prefixes with the Azure default system routes, which include a 0.0.0.0/0 route to the internet. This ensures internet-bound traffic uses the Azure platform's normal outbound path without a forced tunnel through the virtual appliance or VPN gateway.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled.
Why this is correct
This lets the subnet use specific routes for on-premises destinations through the VPN gateway while leaving the default internet route untouched. Because there is no 0.0.0.0/0 UDR, Azure can use the normal system route for internet traffic. Keeping gateway route propagation enabled also allows learned gateway routes to appear when appropriate.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.
- ✗
Create a service endpoint for the subnet and use it as the default next hop.
Why it's wrong here
Service endpoints are for Azure PaaS services, not for general routing to the internet or on-premises prefixes.
- ✗
Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.
Why it's wrong here
NSGs do not choose next hops, so they cannot replace route-table design for this scenario.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume that to send traffic to on-premises networks, they must create a 0.0.0.0/0 UDR to the VPN gateway, but the correct approach is to use specific prefix routes and leave gateway propagation enabled to avoid overriding the default internet path.
Trap categories for this question
Scenario analysis trap
NSGs do not choose next hops, so they cannot replace route-table design for this scenario.
Detailed technical explanation
How to think about this question
Under the hood, Azure's effective route calculation merges user-defined routes (UDRs), system routes, and BGP-propagated routes from the VPN gateway (if gateway propagation is enabled). By specifying only the on-premises prefixes in the UDR, the subnet's routing table retains the default system 0.0.0.0/0 route to the internet, while traffic to the on-premises prefixes is explicitly directed to the VPN gateway. A subtle behavior is that if gateway propagation is enabled and the on-premises network advertises a default route (0.0.0.0/0) via BGP, that route would override the system default and force all internet traffic through the VPN; however, the administrator can control this by not propagating that specific route or by using a higher-priority UDR for the on-premises prefixes.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Implement and Manage Virtual Networking — study guide chapter
Learn the concepts, then practise the questions
- →
Implement and Manage Virtual Networking practice questions
Targeted practice on this topic area only
- →
All AZ-104 questions
1,170 questions across all exam domains
- →
AZ-104 study guide
Full concept coverage aligned to exam objectives
- →
AZ-104 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-104 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Manage Azure Identities and Governance practice questions
Practise AZ-104 questions linked to Manage Azure Identities and Governance.
Implement and Manage Storage practice questions
Practise AZ-104 questions linked to Implement and Manage Storage.
Deploy and Manage Azure Compute practice questions
Practise AZ-104 questions linked to Deploy and Manage Azure Compute.
Implement and Manage Virtual Networking practice questions
Practise AZ-104 questions linked to Implement and Manage Virtual Networking.
Monitor and Maintain Azure Resources practice questions
Practise AZ-104 questions linked to Monitor and Maintain Azure Resources.
AZ-104 Azure RBAC practice questions
Practise AZ-104 questions linked to AZ-104 Azure RBAC.
AZ-104 storage account practice questions
Practise AZ-104 questions linked to AZ-104 storage account.
AZ-104 virtual network practice questions
Practise AZ-104 questions linked to AZ-104 virtual network.
AZ-104 NSG practice questions
Practise AZ-104 questions linked to AZ-104 NSG.
AZ-104 Azure Monitor practice questions
Practise AZ-104 questions linked to AZ-104 Azure Monitor.
AZ-104 backup practice questions
Practise AZ-104 questions linked to AZ-104 backup.
AZ-104 managed identity practice questions
Practise AZ-104 questions linked to AZ-104 managed identity.
Practice this exam
Start a free AZ-104 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-104 question test?
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled. — Option A is correct because it uses a route table with only the specific on-premises prefixes, which forces traffic destined for those prefixes through the VPN gateway, while leaving gateway route propagation enabled. With gateway propagation enabled, the VPN gateway's learned routes (including the 0.0.0.0/0 route from the on-premises network) are not automatically added to the subnet's route table unless explicitly propagated; instead, the subnet's effective routes combine the user-defined routes (UDRs) for on-premises prefixes with the Azure default system routes, which include a 0.0.0.0/0 route to the internet. This ensures internet-bound traffic uses the Azure platform's normal outbound path without a forced tunnel through the virtual appliance or VPN gateway.
What should I do if I get this AZ-104 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.