The answer is to add a user-defined route with destination 10.50.0.0/16 and next hop type Virtual network gateway. This is correct because a user-defined route for a specific prefix to a VPN gateway overrides the default system route for that traffic, forcing packets destined for the on-premises network through the VPN tunnel while leaving the default 0.0.0.0/0 route to the Internet intact. On the AZ-104 exam, this scenario tests your understanding of route precedence and how to force-tunnel specific traffic without disrupting general internet access. A common trap is selecting a next hop of Internet or Virtual appliance, but the VPN gateway is the only next hop type that directly routes over a Site-to-Site VPN connection. Remember the key principle: more specific prefixes win, so a /16 route overrides the default /0 route for that range only. Memory tip: “Specific prefix, VPN gateway—everything else stays the same way.”
AZ-104 Implement and Manage Virtual Networking Practice Question
This AZ-104 practice question tests your understanding of implement and manage virtual networking. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Destination 10.50.0.0/16 with next hop type Virtual network gateway.
Option A is correct because the VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Destination 10.50.0.0/16 with next hop type Virtual network gateway.
Why this is correct
This specific route overrides the default system route only for the on-premises prefix.
Related concept
Read the scenario before looking for a memorised answer.
✗
Destination 0.0.0.0/0 with next hop type Virtual network gateway.
Why it's wrong here
A default route would send all traffic to the gateway, not only the target prefix.
✗
Destination 10.50.0.0/16 with next hop type Service endpoint.
Why it's wrong here
Service endpoints are for PaaS service access, not for routing to on-premises networks.
✗
Destination 10.50.0.0/16 with next hop type Internet.
Why it's wrong here
The Internet next hop cannot direct traffic into an on-premises VPN path.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the default route (0.0.0.0/0) with a specific destination route, mistakenly thinking that forcing all traffic through the VPN gateway is required, when only the specific on-premises network range needs to be routed that way.
Detailed technical explanation
How to think about this question
User-defined routes (UDRs) in Azure override the system default routes for a subnet. When you specify a next hop type of 'Virtual network gateway', Azure routes the traffic to the VPN gateway, which then encapsulates it using IPsec/IKE protocols and sends it over the VPN tunnel to the on-premises network. The route table is applied at the subnet level, and the most specific route (longest prefix match) takes precedence, so the 10.50.0.0/16 route will be used over the default 0.0.0.0/0 route for that destination.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Destination 10.50.0.0/16 with next hop type Virtual network gateway. — Option A is correct because the VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.
What should I do if I get this AZ-104 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.