AZ-104 Implement and Manage Virtual Networking Practice Question
A VM in a subnet must send traffic to 172.16.0.0/16 through a network virtual appliance, but all other destinations should continue using the default Azure system routes. What should the administrator add to the subnet route table?
⚠ Common exam trap
Candidates often confuse the 0.0.0.0/0 route (which controls all internet-bound traffic) with a specific prefix route, mistakenly thinking they must add a default route to force traffic through the NVA, when in fact only the specific destination prefix needs a custom route.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A route for 172.16.0.0/16 with next hop Virtual appliance.
The requirement is to route traffic destined for 172.16.0.0/16 through a network virtual appliance (NVA) while leaving all other traffic to use the default Azure system routes. Adding a user-defined route (UDR) with destination 172.16.0.0/16 and next hop Virtual appliance overrides the default system route for that specific prefix, ensuring traffic to that range is forwarded to the NVA. All other destinations remain unaffected because the 0.0.0.0/0 default route is not modified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A route for 0.0.0.0/0 with next hop Virtual appliance.
Why it's wrong here
A 0.0.0.0/0 route with a virtual appliance as next hop is a default route that matches every destination IP, including but not limited to 172.16.0.0/16. While it would indeed send the target traffic to the appliance, it would also force all internet-bound and other traffic through the appliance, causing inefficient hair-pinning and potentially breaking connectivity. Since the requirement is to send only 172.16.0.0/16 traffic through the appliance, this over-broad route is incorrect.
When this WOULD be correct
This option would be correct if the requirement was to force all outbound traffic (including internet traffic) through a network virtual appliance for inspection or logging, while still allowing internal traffic to use default routes. For example, a question asking to route all egress traffic through a firewall.
- ✓
A route for 172.16.0.0/16 with next hop Virtual appliance.
Why this is correct
A specific user-defined route (UDR) for 172.16.0.0/16 with next hop set to a virtual appliance is correct because Azure selects the most specific route (longest-prefix match). This route overrides the system route for that exact destination, so only traffic bound for 172.16.0.0/16 is sent to the appliance. All other traffic continues to follow existing system routes, meeting the requirement without causing unnecessary hair-pinning.
- ✗
An NSG deny rule for all other destinations.
Why it's wrong here
An NSG deny rule for all other destinations would not satisfy the routing requirement because NSGs are stateful filtering mechanisms that only allow or deny packets based on source/destination/port. They never alter the next hop or forwarding path; routing decisions happen before NSG evaluation. Furthermore, blocking 'all other destinations' would only drop traffic and would not forward the 172.16.0.0/16 traffic to the appliance. Therefore, this option is ineffectual for directing traffic.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to restrict all outbound traffic from a subnet except to a specific destination, and the traffic must be blocked rather than routed. For example, a question asking: 'You need to ensure that VMs in a subnet can only communicate with 172.16.0.0/16 and all other traffic is denied. What should you configure?'
- ✗
A service endpoint for the 172.16.0.0/16 network.
Why it's wrong here
A service endpoint applies only to supported Azure service public IP ranges (for example, Storage or SQL) and is used to secure traffic to those services via the Azure backbone. It cannot be defined for an arbitrary private IP prefix such as 172.16.0.0/16, and service endpoints do not control next-hop routing—they simply change the source IP and path for the matched Azure service. Thus, this option is invalid for steering traffic to a virtual appliance.
When this WOULD be correct
A service endpoint would be correct if the question asked for securing traffic to an Azure service (e.g., Azure Storage or SQL Database) from a subnet, ensuring that traffic remains on the Azure backbone and is not routed through the internet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A route for 172.16.0.0/16 with next hop Virtual appliance.Correct answer▾
Why this is correct
A specific user-defined route (UDR) for 172.16.0.0/16 with next hop set to a virtual appliance is correct because Azure selects the most specific route (longest-prefix match). This route overrides the system route for that exact destination, so only traffic bound for 172.16.0.0/16 is sent to the appliance. All other traffic continues to follow existing system routes, meeting the requirement without causing unnecessary hair-pinning.
✗A route for 0.0.0.0/0 with next hop Virtual appliance.Wrong answer — click to see why▾
Why this is wrong here
A route for 0.0.0.0/0 with next hop Virtual appliance would redirect all internet-bound and other traffic to the appliance, not just traffic to 172.16.0.0/16. The requirement is to only route traffic to 172.16.0.0/16 through the appliance while keeping default system routes for other destinations.
★ When this WOULD be the correct answer
This option would be correct if the requirement was to force all outbound traffic (including internet traffic) through a network virtual appliance for inspection or logging, while still allowing internal traffic to use default routes. For example, a question asking to route all egress traffic through a firewall.
Why candidates choose this
Candidates may think that a default route (0.0.0.0/0) is needed to override system routes for all traffic, but they overlook the specific requirement to only redirect traffic to a particular subnet.
✗An NSG deny rule for all other destinations.Wrong answer — click to see why▾
Why this is wrong here
An NSG deny rule for all other destinations would block traffic to all destinations except those explicitly allowed, but the requirement is to only redirect traffic to 172.16.0.0/16 through the NVA while keeping default system routes for other destinations. NSGs are stateful and do not affect traffic routing; they filter traffic but do not change the next hop.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to restrict all outbound traffic from a subnet except to a specific destination, and the traffic must be blocked rather than routed. For example, a question asking: 'You need to ensure that VMs in a subnet can only communicate with 172.16.0.0/16 and all other traffic is denied. What should you configure?'
Why candidates choose this
Candidates may think that denying all other destinations with an NSG is a simpler way to force traffic through the NVA, misunderstanding that NSGs do not control routing paths but only filter traffic based on rules.
✗A service endpoint for the 172.16.0.0/16 network.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints are used to secure Azure service traffic to a virtual network, not to route traffic to on-premises or non-Azure destinations like 172.16.0.0/16. They do not affect routing behavior for arbitrary IP ranges.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question asked for securing traffic to an Azure service (e.g., Azure Storage or SQL Database) from a subnet, ensuring that traffic remains on the Azure backbone and is not routed through the internet.
Why candidates choose this
Candidates may confuse service endpoints with custom routing because both involve directing traffic to specific destinations, but service endpoints are for Azure services only, not general IP ranges.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Route table
A route table is a set of rules, called routes, that determine where network traffic from a subnet or virtual network is directed.
Key term
UDR
UDR is a user-defined routing rule that controls how network traffic moves between subnets or to external destinations in a cloud or on-premises environment.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.