AZ-104 Implement and Manage Virtual Networking Practice Question
An administrator creates a route table with a UDR for 10.20.0.0/16 and next hop type Virtual appliance. A VM in the subnet still does not send that traffic to the appliance. The route table contents are correct. What should be checked first?
⚠ Common exam trap
The trap here is that candidates often focus on the route table contents being correct and overlook the critical step of associating the route table with the subnet, assuming that creating the route table is sufficient to apply it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whether the route table is associated with the correct subnet.
The most common reason a UDR fails to take effect is that the route table is not associated with the subnet containing the VM. Even if the route table contents are correct, the VM's traffic will follow default system routes unless the route table is explicitly linked to the subnet. Association is a required step to override Azure's default routing behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Whether the NSG has an outbound deny rule for port 80.
Why it's wrong here
An NSG outbound deny rule for port 80 would block egress packets at the network interface, but it does not reroute traffic nor prevent a UDR from being evaluated. The reported symptom—that the UDR is not used at all—points to route-table association, not to packet filtering. NSGs and route tables are independent control-plane components: one filters, the other dictates path forwarding.
When this WOULD be correct
This option would be correct if the question described that traffic to a specific destination (e.g., 10.20.0.0/16) is being blocked, and the route table is correctly associated and configured. In that case, checking NSG outbound rules for deny rules would be the first step to identify if the traffic is being blocked by the network security group.
- ✓
Whether the route table is associated with the correct subnet.
Why this is correct
A route table only affects traffic for the subnet to which it is associated. If the table exists and the route is correct but traffic still follows another path, the first thing to verify is that the VM's subnet is actually linked to that route table. Without that association, the UDR is never applied, even though the route definition itself looks valid.
- ✗
Whether the VM uses a managed identity.
Why it's wrong here
A managed identity provides the VM an Azure AD identity for authenticated access to services; it does not participate in network-layer routing decisions. Azure's routing stack evaluates the subnet's route table based solely on IP prefixes and next-hop types, never on identity attributes. Therefore, checking whether a managed identity is enabled cannot explain why a UDR is not being honored.
When this WOULD be correct
A question where a VM cannot access a storage account or Key Vault, and the answer options include checking managed identity assignment. If the VM is not assigned the correct managed identity, access would fail despite correct network rules.
- ✗
Whether the virtual machine is in an availability set.
Why it's wrong here
Availability sets place VMs into different fault and update domains to protect applications from rack-level failures; this infrastructure-level placement has no relation to L3 routing. A route table's effect is determined by its association to the subnet, and every VM in that subnet inherits those routes regardless of fault domain membership. Investigating availability-set membership is irrelevant to a missing route-table association.
When this WOULD be correct
In a question about high availability for a web application, where the correct answer is to place VMs in an availability set to protect against datacenter failures.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Whether the route table is associated with the correct subnet.Correct answer▾
Why this is correct
A route table only affects traffic for the subnet to which it is associated. If the table exists and the route is correct but traffic still follows another path, the first thing to verify is that the VM's subnet is actually linked to that route table. Without that association, the UDR is never applied, even though the route definition itself looks valid.
✗Whether the NSG has an outbound deny rule for port 80.Wrong answer — click to see why▾
Why this is wrong here
The question states that the route table contents are correct, so the issue is not about NSG rules but about route application. An NSG outbound deny rule for port 80 would block traffic regardless of routing, but the problem is that traffic is not being sent to the appliance, which is a routing issue, not a firewall issue.
★ When this WOULD be the correct answer
This option would be correct if the question described that traffic to a specific destination (e.g., 10.20.0.0/16) is being blocked, and the route table is correctly associated and configured. In that case, checking NSG outbound rules for deny rules would be the first step to identify if the traffic is being blocked by the network security group.
Why candidates choose this
Candidates often confuse routing and network security, assuming that if traffic doesn't reach its destination, it must be blocked by an NSG rule. They may overlook that the route table might not be applied to the correct subnet, which is a more fundamental issue.
✗Whether the VM uses a managed identity.Wrong answer — click to see why▾
Why this is wrong here
Managed identities are used for authenticating to Azure services without credentials, not for controlling network traffic routing. The issue is about traffic not following a UDR, which is unrelated to identity.
★ When this WOULD be the correct answer
A question where a VM cannot access a storage account or Key Vault, and the answer options include checking managed identity assignment. If the VM is not assigned the correct managed identity, access would fail despite correct network rules.
Why candidates choose this
Candidates may confuse managed identities with service endpoints or think that identity issues can affect network routing, especially when troubleshooting connectivity problems.
✗Whether the virtual machine is in an availability set.Wrong answer — click to see why▾
Why this is wrong here
The VM being in an availability set does not affect routing behavior; route table association is the primary factor for traffic redirection.
★ When this WOULD be the correct answer
In a question about high availability for a web application, where the correct answer is to place VMs in an availability set to protect against datacenter failures.
Why candidates choose this
Candidates may confuse availability set with subnet association, thinking that the VM's placement group influences routing, but routing is determined by subnet-level route tables.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Route table
A route table is a set of rules, called routes, that determine where network traffic from a subnet or virtual network is directed.
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.