AZ-104 Implement and Manage Virtual Networking Practice Question
A workload subnet must send all outbound internet traffic through a network virtual appliance at 10.4.2.4. What should the administrator configure?
⚠ Common exam trap
Watch out — candidates often confuse NSG rules with routing: an NSG can block or allow traffic, but it cannot change the path traffic takes, so they incorrectly choose Option A thinking a permit rule will force traffic through the appliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.
A user-defined route (UDR) with a destination of 0.0.0.0/0 and a next hop of Virtual Appliance (10.4.2.4) overrides the default system route for internet traffic, forcing all outbound traffic from the subnet to be forwarded to the network virtual appliance (NVA) for inspection or NAT. This is the standard method to implement forced tunneling or centralized internet egress in Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An NSG rule that allows outbound traffic to 10.4.2.4.
Why it's wrong here
A network security group (NSG) rule operates at the network layer 4 as a stateful firewall, filtering allowed or denied connections, not as a routing mechanism. An outbound rule permitting traffic to 10.4.2.4 only ensures that packets to that destination are allowed through; it does not redirect traffic destined elsewhere to that IP. All other internet traffic will still take the default Azure route unless a user-defined route explicitly directs it.
When this WOULD be correct
An NSG rule allowing outbound traffic to 10.4.2.4 would be correct if the requirement is to permit traffic to that specific IP (e.g., to allow management traffic to a network virtual appliance) while other outbound traffic is handled differently, such as through default internet routing.
- ✓
A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.
Why this is correct
A user-defined route (UDR) with the address prefix 0.0.0.0/0 and a next hop of 10.4.2.4 (typically configured as a VirtualAppliance) overrides Azure's default system route for internet-bound traffic. When the route table is associated with the workload subnet, every packet destined to the internet is forwarded to 10.4.2.4, which acts as a forced tunneling point or network virtual appliance (NVA).
- ✗
A private DNS zone for the subnet.
Why it's wrong here
A private DNS zone only influences hostname resolution within the virtual network, translating DNS names to IP addresses for clients. It does not participate in the IP forwarding decision for packets, nor does it set a next hop for outbound traffic. Even with a private DNS zone, the operating system's routing table and Azure's effective routes still determine where packets are sent, so it cannot force all internet traffic to a specific device.
When this WOULD be correct
A private DNS zone would be correct if the question asked: 'You need to ensure that resources in a subnet can resolve a custom domain name (e.g., contoso.com) to a private IP address within the virtual network.'
- ✗
A service endpoint for the virtual network.
Why it's wrong here
Virtual network service endpoints extend the virtual network identity and enforce service-level policies for traffic to specific Azure PaaS services (such as Azure Storage or SQL Database) by routing it over the Microsoft backbone. They are configured per service and per subnet, but they do not send or steer all general internet traffic to a particular IP address. Service endpoints also do not introduce a next hop; they simply enable private access to PaaS endpoints while preserving the existing system route for internet traffic.
When this WOULD be correct
A service endpoint would be correct if the question required a subnet to securely access an Azure service (e.g., Azure Storage or SQL Database) without sending traffic over the internet, by routing it through the Azure backbone network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.Correct answer▾
Why this is correct
A user-defined route (UDR) with the address prefix 0.0.0.0/0 and a next hop of 10.4.2.4 (typically configured as a VirtualAppliance) overrides Azure's default system route for internet-bound traffic. When the route table is associated with the workload subnet, every packet destined to the internet is forwarded to 10.4.2.4, which acts as a forced tunneling point or network virtual appliance (NVA).
✗An NSG rule that allows outbound traffic to 10.4.2.4.Wrong answer — click to see why▾
Why this is wrong here
An NSG rule controls traffic based on IP addresses but does not force all outbound internet traffic through a specific IP; it only allows or denies traffic. To route all internet-bound traffic through 10.4.2.4, a user-defined route (UDR) with 0.0.0.0/0 next hop to that IP is required.
★ When this WOULD be the correct answer
An NSG rule allowing outbound traffic to 10.4.2.4 would be correct if the requirement is to permit traffic to that specific IP (e.g., to allow management traffic to a network virtual appliance) while other outbound traffic is handled differently, such as through default internet routing.
Why candidates choose this
Candidates may confuse NSG rules with routing, thinking that allowing traffic to the appliance's IP is sufficient to direct all internet traffic through it, not realizing that routing is controlled by route tables, not NSGs.
✗A private DNS zone for the subnet.Wrong answer — click to see why▾
Why this is wrong here
A private DNS zone resolves domain names within a virtual network, but it does not control routing of outbound internet traffic. The question requires sending traffic through a network virtual appliance, which is a routing function, not a DNS function.
★ When this WOULD be the correct answer
A private DNS zone would be correct if the question asked: 'You need to ensure that resources in a subnet can resolve a custom domain name (e.g., contoso.com) to a private IP address within the virtual network.'
Why candidates choose this
Candidates may confuse DNS resolution with traffic routing, thinking that a private DNS zone can redirect internet-bound traffic by resolving domains to the appliance's IP, but DNS does not force all traffic through that IP.
✗A service endpoint for the virtual network.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints provide direct, private connectivity from a subnet to Azure PaaS services, not to a network virtual appliance. They do not route all outbound internet traffic through a specific IP address.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question required a subnet to securely access an Azure service (e.g., Azure Storage or SQL Database) without sending traffic over the internet, by routing it through the Azure backbone network.
Why candidates choose this
Candidates may confuse service endpoints with routing traffic to a network virtual appliance, thinking that a service endpoint can redirect all outbound traffic, when in fact it only applies to specific Azure services.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
User-defined route
A user-defined route (UDR) is a custom routing rule you create in a cloud or on-premises network to override or supplement the system's default routing behavior, directing network traffic along a specific path.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.