AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A user-defined route for 172.16.0.0/16 with next hop type Virtual network gateway.

  Why this is correct

  When gateway route propagation is disabled, the subnet no longer learns on-premises routes automatically from the VPN gateway. Adding a specific route for the on-premises prefix with next hop Virtual network gateway restores reachability to that network while keeping the forced-tunneling design for other traffic.

• ✗

  A user-defined route for 172.16.0.0/16 with next hop type Internet.

  Why it's wrong here

  A user-defined route with next hop type Internet for 172.16.0.0/16 would force all traffic destined for the on-premises network to be sent to the Azure Internet edge, which is not a path to a private VPN tunnel. The virtual network gateway is reachable only via the virtual network's infrastructure, not through an Internet hop, so this route would misdirect the traffic and cause it to be dropped because Azure discards traffic sent to the Internet for private IP ranges. This makes the on-premises range unreachable and is the opposite of the intended hybrid connectivity.

  When this WOULD be correct

  This option would be correct if the question asked how to force internet-bound traffic from the subnet through a network virtual appliance, or if the on-premises network was reachable via the internet (e.g., using a public IP).

• ✗

  An NSG allow rule for TCP 172.16.0.0/16.

  Why it's wrong here

  An NSG is a stateful firewall that filters traffic by IP address, protocol, and port; it does not participate in route selection or modify the subnet's effective route table. In this scenario, the problem is that the subnet no longer learns the 172.16.0.0/16 route from the VPN gateway because gateway propagation is disabled. Even if an NSG allow rule permitted outbound TCP to that prefix, the subnet still has no next hop for it, so packets would be dropped or sent to the default route rather than to the virtual network gateway.

  When this WOULD be correct

  An NSG allow rule for 172.16.0.0/16 would be correct if the question described that VMs cannot reach on-premises servers due to an NSG denying the traffic, and the solution required allowing inbound or outbound traffic on a specific port (e.g., TCP 3389 for RDP).

• ✗

  A service endpoint for the on-premises network range.

  Why it's wrong here

  Service endpoints are only available for Microsoft Azure services, such as Azure Storage or Azure SQL Database, and they add routes to the public IP ranges of those services using the Microsoft backbone. You cannot configure a service endpoint for an arbitrary private IP prefix like 172.16.0.0/16, nor would it create a route to a VPN gateway or on-premises network. Even if you could, service endpoints do not affect traffic destined for external private networks, so they cannot replace the missing gateway route.

  When this WOULD be correct

  A service endpoint would be correct if the question asked how to ensure that traffic from a subnet to an Azure service (e.g., Azure Storage) stays within the Microsoft backbone and does not traverse the internet, while also restricting access to that service from only that subnet.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question