A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?

Remove the default route so all traffic uses the system routes.

Removing the default route would send all outbound traffic away from the firewall, not just one destination.

Create a service endpoint for the server and the update site.

Service endpoints apply to supported Azure PaaS services, not arbitrary Internet IP addresses.

Attach a NAT gateway to the subnet so the server can bypass the firewall.

A NAT gateway changes outbound source addressing, but it does not override a UDR to a firewall appliance.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Add a more specific /32 route for 40.90.10.25 with next hop type Internet. — Azure selects the most specific matching route first. Because the subnet already has a default route to a firewall, the only practical way to exempt a single destination is to add a /32 UDR for that IP with next hop type Internet. That more specific route overrides the broader default route for just that host, while keeping all other outbound traffic forced through the firewall appliance. Why others are wrong: Removing the default route defeats the requirement to keep everything else on the firewall path. Service endpoints only work with supported Azure services, not arbitrary public IPs. NAT Gateway handles outbound translation, but it does not take precedence over a user-defined route to a virtual appliance. The issue is route selection, not source IP translation.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.