AZ-104 Implement and Manage Virtual Networking Practice Question
A VM sends traffic to 172.16.5.10, but the administrator suspects the traffic is taking an unexpected next hop. They want to see the effective route table applied to the VM NIC, including system routes, user-defined routes, and propagated routes. Which Network Watcher tool should be used?
⚠ Common exam trap
Test-takers frequently confuse IP flow verify (which checks NSG rules) with effective routes (which checks routing), leading them to pick A when the question explicitly asks about the route table and next hop, not firewall rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Effective routes
Effective routes is the correct Network Watcher tool because it displays the complete route table applied to a VM NIC, including system routes, user-defined routes (UDRs), and BGP-propagated routes from virtual network gateways. This allows the administrator to see exactly which next hop is selected for traffic to 172.16.5.10 based on the longest prefix match, identifying any unexpected routing behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP flow verify
Why it's wrong here
IP flow verify in Network Watcher tests a specific 5-tuple (source IP, destination IP, source port, destination port, protocol) against the effective NSG rules to determine whether the traffic is allowed or denied. It does not evaluate or display user-defined routes, system routes, or BGP routes, so it lacks any next-hop information. Because the question is about why traffic is sent to a particular IP address, not whether it is permitted, IP flow verify is the wrong tool.
When this WOULD be correct
When the question asks to confirm whether traffic to a specific IP is allowed or blocked by network security groups (NSGs) or firewall rules, IP flow verify is the correct tool.
- ✓
Effective routes
Why this is correct
Effective routes displays the full route set that applies to a VM NIC, including system, user-defined, and propagated routes. That makes it the right tool when you need to understand why traffic is taking a particular next hop.
- ✗
Packet capture
Why it's wrong here
Packet capture on a virtual machine collects raw network packets traversing the NIC and saves them to a .pcap or .npcap file for protocol-level analysis. It only records the actual data flowing at the time of capture, so it would show the traffic being sent to 172.16.5.10, but it would not explain the routing logic behind that choice. To see the route table and next-hop selection, you need a tool that queries the platform's routing state, not one that passively observes traffic.
When this WOULD be correct
Packet capture would be correct if the question asked: 'An administrator needs to capture inbound and outbound traffic to a VM to analyze a network anomaly. Which Network Watcher tool should be used?'
- ✗
Connection troubleshoot
Why it's wrong here
Connection troubleshoot performs an end-to-end diagnostic by sending synthetic connectivity checks (ICMP, TCP, or HTTP) from a source VM to a destination, such as a VM, FQDN, or public IP, and returns a detailed report of latency, packet loss, and potential issues. Although it may identify routing problems as part of its findings, its primary purpose is to verify connectivity and performance, not to enumerate the full set of effective routes applied to a NIC. It also requires the destination to be reachable to produce meaningful output, making it unsuitable as a pure route-table inspection tool.
When this WOULD be correct
When an administrator needs to diagnose why a VM cannot connect to a specific IP address or port, and wants to check for blocking NSGs, user-defined routes, or latency issues along the path.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Effective routesCorrect answer▾
Why this is correct
Effective routes displays the full route set that applies to a VM NIC, including system, user-defined, and propagated routes. That makes it the right tool when you need to understand why traffic is taking a particular next hop.
✗IP flow verifyWrong answer — click to see why▾
Why this is wrong here
IP flow verify tests connectivity by checking if traffic is allowed or denied between a source and destination, but it does not show the effective route table or next hop information.
★ When this WOULD be the correct answer
When the question asks to confirm whether traffic to a specific IP is allowed or blocked by network security groups (NSGs) or firewall rules, IP flow verify is the correct tool.
Why candidates choose this
Candidates may confuse IP flow verify with route verification because both involve network troubleshooting, but IP flow verify focuses on security rules, not routing.
✗Packet captureWrong answer — click to see why▾
Why this is wrong here
Packet capture captures raw network traffic for analysis, but it does not show the effective route table applied to a VM NIC. The question specifically asks for the tool to view effective routes, not to capture packets.
★ When this WOULD be the correct answer
Packet capture would be correct if the question asked: 'An administrator needs to capture inbound and outbound traffic to a VM to analyze a network anomaly. Which Network Watcher tool should be used?'
Why candidates choose this
Candidates may confuse packet capture with route analysis, thinking that capturing packets will reveal the path traffic takes, but packet capture only shows the traffic content, not the routing decisions.
✗Connection troubleshootWrong answer — click to see why▾
Why this is wrong here
Connection troubleshoot is used to check TCP connectivity between a source and destination, not to view the effective route table applied to a VM NIC.
★ When this WOULD be the correct answer
When an administrator needs to diagnose why a VM cannot connect to a specific IP address or port, and wants to check for blocking NSGs, user-defined routes, or latency issues along the path.
Why candidates choose this
Candidates may confuse 'troubleshoot' with 'diagnose routing issues' and think Connection troubleshoot covers all network diagnostics, including route inspection.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Virtual Machine Deployment
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Network Watcher
Network Watcher is a monitoring and diagnostics service used in cloud environments to track network traffic, detect issues, and analyze performance between virtual machines and other resources.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.