AZ-104 Implement and Manage Virtual Networking Practice Question
A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?
⚠ Common exam trap
A common mix-up: candidates confuse the default route (0.0.0.0/0) with a specific destination route, mistakenly thinking that forcing all traffic through the VPN gateway is required, when only the specific on-premises network range needs to be routed that way.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destination 10.50.0.0/16 with next hop type Virtual network gateway.
The VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Destination 10.50.0.0/16 with next hop type Virtual network gateway.
Why this is correct
This user-defined route is correct because 10.50.0.0/16 is an on-premises private prefix, and specifying a virtual network gateway as the next hop for that exact destination creates a targeted override of the default system route. Azure uses longest-prefix-match (LPM), so this more-specific route wins over the 0.0.0.0/0 system route and directs only the 10.50.0.0/16 traffic through the VPN or ExpressRoute gateway. All other traffic continues to use existing system routes, keeping the routing behavior isolated to the intended on-premises destination.
- ✗
Destination 0.0.0.0/0 with next hop type Virtual network gateway.
Why it's wrong here
The 0.0.0.0/0 route with a virtual network gateway is far too broad because 0.0.0.0/0 is the catch-all prefix that matches all traffic. Implementing this route would force every packet leaving the virtual network—including internet-bound traffic—to go through the on-premises gateway, which would break the default Azure internet path and require all egress to be backhauled through the VPN tunnel. Since the requirement is only to reach the specific 10.50.0.0/16 prefix, this default route is both unnecessary and disruptive to normal connectivity.
When this WOULD be correct
If the requirement were to force all outbound traffic from the subnet through the on-premises network (e.g., for security inspection or centralized internet breakout), then a 0.0.0.0/0 route with next hop Virtual network gateway would be correct.
- ✗
Destination 10.50.0.0/16 with next hop type Service endpoint.
Why it's wrong here
Service endpoints are not a valid route table next hop type and are not designed for routing to on-premises networks; they work by extending the virtual network boundary to specific Azure PaaS services, such as storage or SQL, over the Azure backbone. Configuring a next hop of 'Service endpoint' for 10.50.0.0/16 would neither create a tunnel nor forward packets to on-premises, so traffic would fail to arrive. The only next-hop type that can forward traffic to an on-premises network through a VPN or ExpressRoute gateway is 'Virtual network gateway'.
When this WOULD be correct
When the destination is an Azure service (e.g., Azure Storage or SQL Database) and you want traffic to stay within the Azure backbone instead of going through the internet or a VPN. For example: 'Route traffic from a subnet to Azure Storage using a service endpoint.'
- ✗
Destination 10.50.0.0/16 with next hop type Internet.
Why it's wrong here
The Internet next hop type cannot deliver traffic to a private RFC 1918 address range such as 10.50.0.0/16 because Azure would send those packets to the public Internet, where private addresses are non-routable and would be dropped. Additionally, a next hop of Internet does not establish any VPN or ExpressRoute encryption/tunnel, so even public IP traffic would not reach an on-premises network through a gateway. To route to an on-premises site, the destination prefix must point to a virtual network gateway, which is the only next hop capable of providing the hybrid connectivity path.
When this WOULD be correct
If the question required routing traffic to a public IP range (e.g., 0.0.0.0/0) via the internet, or if the destination was a public endpoint reachable directly over the internet, then next hop type Internet would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Destination 10.50.0.0/16 with next hop type Virtual network gateway.Correct answer▾
Why this is correct
This user-defined route is correct because 10.50.0.0/16 is an on-premises private prefix, and specifying a virtual network gateway as the next hop for that exact destination creates a targeted override of the default system route. Azure uses longest-prefix-match (LPM), so this more-specific route wins over the 0.0.0.0/0 system route and directs only the 10.50.0.0/16 traffic through the VPN or ExpressRoute gateway. All other traffic continues to use existing system routes, keeping the routing behavior isolated to the intended on-premises destination.
✗Destination 0.0.0.0/0 with next hop type Virtual network gateway.Wrong answer — click to see why▾
Why this is wrong here
This route would send ALL traffic (0.0.0.0/0) through the VPN gateway, but the requirement is to send only 10.50.0.0/16 traffic through the VPN and all other traffic through the Internet.
★ When this WOULD be the correct answer
If the requirement were to force all outbound traffic from the subnet through the on-premises network (e.g., for security inspection or centralized internet breakout), then a 0.0.0.0/0 route with next hop Virtual network gateway would be correct.
Why candidates choose this
Candidates may mistakenly think that a default route (0.0.0.0/0) is needed to override the system default Internet route, or they confuse the need for a specific route with a general forced-tunneling scenario.
✗Destination 10.50.0.0/16 with next hop type Service endpoint.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints route traffic to Azure service IP ranges, not to on-premises networks like 10.50.0.0/16. They cannot forward traffic through a VPN gateway.
★ When this WOULD be the correct answer
When the destination is an Azure service (e.g., Azure Storage or SQL Database) and you want traffic to stay within the Azure backbone instead of going through the internet or a VPN. For example: 'Route traffic from a subnet to Azure Storage using a service endpoint.'
Why candidates choose this
Candidates may confuse service endpoints with VPN gateways, thinking both can route to specific IP ranges, or they may incorrectly assume service endpoints can handle any custom IP range.
✗Destination 10.50.0.0/16 with next hop type Internet.Wrong answer — click to see why▾
Why this is wrong here
The destination 10.50.0.0/16 is a private IP range, and the Internet next hop type cannot route private IP traffic to the internet; it would drop the traffic or route it incorrectly.
★ When this WOULD be the correct answer
If the question required routing traffic to a public IP range (e.g., 0.0.0.0/0) via the internet, or if the destination was a public endpoint reachable directly over the internet, then next hop type Internet would be correct.
Why candidates choose this
Candidates may mistakenly think that any destination can be routed through the internet, or they confuse the Internet next hop with a default route for internet-bound traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.