AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add an NSG outbound allow rule for TCP 80 and TCP 443.

  Why it's wrong here

  An NSG outbound allow rule for TCP 80 and TCP 443 only permits the traffic; it does not control the subnet's next-hop routing. The custom 0.0.0.0/0 route to the virtual appliance still overrides the default internet route, so the NAT gateway's public IP is never used. NSGs are stateful packet filters, not routers, so they cannot redirect traffic to the NAT gateway or alter the source IP for outbound connections.

  When this WOULD be correct

  In a scenario where the subnet has no UDR for 0.0.0.0/0 and the goal is to restrict outbound traffic to only HTTP/HTTPS, adding an NSG outbound allow rule for TCP 80 and 443 would be correct.

• ✓

  Remove or replace the 0.0.0.0/0 UDR to the virtual appliance and associate the NAT gateway with the subnet.

  Why this is correct

  A NAT gateway provides stable outbound internet connectivity only when traffic follows the normal internet path from the subnet. The custom default route to a virtual appliance forces traffic away from that path, so the NAT gateway is bypassed. Removing or replacing the forced-tunnel route and then attaching the NAT gateway to the subnet allows outbound internet traffic to use the NAT gateway’s public IPs.

• ✗

  Create a private endpoint for the web workload.

  Why it's wrong here

  A private endpoint assigns a private IP address for inbound access to an Azure PaaS service, making that service reachable from within the virtual network. This has no effect on the web workload's outbound internet traffic or the source IP visible to external destinations. The outbound path from the subnet is governed by routing and NAT configuration, not by private endpoints, which are designed to bring external services in, not to send local traffic out.

  When this WOULD be correct

  If the question asked how to securely connect an Azure web app to a storage account without exposing it to the public internet, creating a private endpoint for the storage account would be the correct answer.

• ✗

  Enable VNet peering to a hub network with a firewall.

  Why it's wrong here

  VNet peering extends network connectivity between virtual networks, but it does not automatically associate a NAT gateway with the spoke subnet. If the hub's firewall is the next hop for internet traffic, outbound connections will use the firewall's public IP instead of the NAT gateway's IP, which defeats the requirement. To use a NAT gateway, you must attach it directly to the workload's subnet and ensure no forced-tunnel route (like the UDR to the firewall) reroutes 0.0.0.0/0.

  When this WOULD be correct

  In a scenario where an organization wants to centralize outbound traffic inspection and logging through a firewall in a hub network, while also requiring a stable source IP for specific workloads, enabling VNet peering to a hub network with a firewall would be correct. The firewall would then provide the stable source IP.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question