AZ-104 Implement and Manage Virtual Networking Practice Question
An operations team wants all internet-bound traffic from a workload subnet to pass through a network virtual appliance at 10.1.0.4 for inspection. Which next hop type should be used in a user-defined route for destination 0.0.0.0/0?
⚠ Common exam trap
Many candidates confuse 'Virtual appliance' with 'Virtual network gateway', mistakenly thinking a VPN gateway is required to route internet traffic, when in fact the NVA is a simple VM or firewall appliance with IP forwarding enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual appliance
To force all internet-bound traffic from a subnet through a network virtual appliance (NVA) at 10.1.0.4, you must create a user-defined route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance'. This directs traffic to the NVA's private IP for inspection, overriding Azure's default system route that would otherwise send 0.0.0.0/0 traffic directly to the Internet via the Azure backbone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Internet
Why it's wrong here
The 'Internet' next hop type is the default system route for 0.0.0.0/0 and sends traffic directly out to the public internet from the Azure network. This bypasses any NVA or firewall, defeating the purpose of forced tunneling and inspections. Since the team explicitly requires all internet-bound traffic to first pass through the appliance, this next hop would not fulfill the requirement.
When this WOULD be correct
If the question asked for a route that allows internet-bound traffic to exit directly without inspection, or if the goal was to bypass a firewall for specific traffic, then 'Internet' would be the correct next hop type for the 0.0.0.0/0 route.
- ✓
Virtual appliance
Why this is correct
Selecting 'Virtual appliance' as the next hop type creates a user-defined route that directs traffic to the private IP address of a network virtual appliance (NVA) or firewall. By pairing this route with the 0.0.0.0/0 address prefix, all internet-bound traffic is force-tunneled to the appliance for inspection and policy enforcement. This is the only option that explicitly supports forwarding packets to a standalone, non-gateway device inside the VNet.
- ✗
Virtual network gateway
Why it's wrong here
A 'Virtual network gateway' next hop is designed for VPN or ExpressRoute paths, enabling encrypted connectivity to on-premises networks or between VNets. It does not route traffic to an internal NVA or firewall; the gateway resource is a separate service in the gateway subnet, not an inline security appliance. Choosing this would send traffic to the gateway for tunnel-based routing, which is not the intended use case for inspecting outbound internet traffic.
When this WOULD be correct
This option would be correct if the question asked for routing traffic to an on-premises network via a VPN or ExpressRoute connection, where the next hop type should be 'Virtual network gateway'.
- ✗
None
Why it's wrong here
The 'None' next hop type is a blackhole route—any traffic matching the route's address prefix is silently dropped. This is the opposite of the requirement, as the operations team wants to forward internet-bound traffic to an inspection appliance, not discard it. Using 'None' would cause connectivity failures and effectively block outbound internet access.
When this WOULD be correct
A user-defined route with next hop type 'None' is correct when the goal is to block all traffic to a specific destination, such as preventing outbound internet access from a subnet for security reasons.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Virtual applianceCorrect answer▾
Why this is correct
Selecting 'Virtual appliance' as the next hop type creates a user-defined route that directs traffic to the private IP address of a network virtual appliance (NVA) or firewall. By pairing this route with the 0.0.0.0/0 address prefix, all internet-bound traffic is force-tunneled to the appliance for inspection and policy enforcement. This is the only option that explicitly supports forwarding packets to a standalone, non-gateway device inside the VNet.
✗InternetWrong answer — click to see why▾
Why this is wrong here
The next hop type 'Internet' would route traffic directly to the internet, bypassing the network virtual appliance at 10.1.0.4, which fails to meet the requirement for inspection.
★ When this WOULD be the correct answer
If the question asked for a route that allows internet-bound traffic to exit directly without inspection, or if the goal was to bypass a firewall for specific traffic, then 'Internet' would be the correct next hop type for the 0.0.0.0/0 route.
Why candidates choose this
Candidates may think that since the destination is the internet (0.0.0.0/0), the next hop should be 'Internet', overlooking the requirement for traffic to pass through a virtual appliance first.
✗Virtual network gatewayWrong answer — click to see why▾
Why this is wrong here
A virtual network gateway is used for site-to-site VPN or ExpressRoute connections, not for routing traffic to a network virtual appliance. The next hop type for a user-defined route pointing to an NVA must be 'Virtual appliance'.
★ When this WOULD be the correct answer
This option would be correct if the question asked for routing traffic to an on-premises network via a VPN or ExpressRoute connection, where the next hop type should be 'Virtual network gateway'.
Why candidates choose this
Candidates may confuse the term 'gateway' with 'appliance', thinking a virtual network gateway can inspect traffic, or they may mistakenly believe all routing through a gateway is handled by this next hop type.
✗NoneWrong answer — click to see why▾
Why this is wrong here
The 'None' next hop type means traffic is dropped, not routed to the virtual appliance. The question requires traffic to pass through the appliance for inspection, so 'None' would block all internet-bound traffic.
★ When this WOULD be the correct answer
A user-defined route with next hop type 'None' is correct when the goal is to block all traffic to a specific destination, such as preventing outbound internet access from a subnet for security reasons.
Why candidates choose this
Candidates may mistakenly think 'None' means no additional routing is needed, assuming the default route (0.0.0.0/0) will handle traffic, but in UDRs, 'None' explicitly drops traffic.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
User-defined route
A user-defined route (UDR) is a custom routing rule you create in a cloud or on-premises network to override or supplement the system's default routing behavior, directing network traffic along a specific path.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.