- A
Internet, because the default route overrides more specific routes.
Why wrong: A default route is the least specific route available. It does not override a more specific route for the destination address.
- B
Network virtual appliance at 10.1.0.4, because user-defined routes always win over system routes.
Why wrong: User-defined routes do not automatically win when another route is more specific. Azure still applies longest-prefix matching before choosing the winning route.
- C
Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0.
Azure first selects the most specific matching prefix. The destination 10.50.18.25 falls inside the /20 peering route, which is more specific than the 0.0.0.0/0 forced-tunneling route. Because the longest prefix wins, traffic is sent over the peering path rather than to the NVA or the internet.
- D
None, because Azure disables routing when a subnet has both peering and a UDR.
Why wrong: Azure does not disable routing in this situation. It evaluates available routes and applies the route selection rules normally.
Azure Routing Longest Prefix Match
This AZ-104 practice question tests your understanding of implement and manage virtual networking. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: longest prefix match. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.1.0.4. The same virtual network is peered to a hub VNet that has a system route for 10.50.16.0/20. A VM in the subnet sends traffic to 10.50.18.25. Which next hop will Azure use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0.
Azure uses the most specific route (longest prefix match) to determine next hop. The destination 10.50.18.25 falls within the 10.50.16.0/20 range of the peering route, which is more specific than the 0.0.0.0/0 UDR. Therefore, the traffic is routed via the virtual network peering, not the NVA.
Key principle: Longest prefix match
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Internet, because the default route overrides more specific routes.
Why it's wrong here
A default route is the least specific route available. It does not override a more specific route for the destination address.
When this WOULD be correct
If the destination IP were outside the peering range and no other specific route existed, the 0.0.0.0/0 UDR would send traffic to the NVA. For example, a VM sending to 8.8.8.8 would use the default route.
- ✗
Network virtual appliance at 10.1.0.4, because user-defined routes always win over system routes.
Why it's wrong here
User-defined routes do not automatically win when another route is more specific. Azure still applies longest-prefix matching before choosing the winning route.
When this WOULD be correct
If the destination IP fell within the UDR's address prefix (e.g., 0.0.0.0/0) and no more specific route existed, the UDR would be used. For example, a subnet with a UDR for 0.0.0.0/0 to an NVA and no peering or other specific routes for the destination.
- ✓
Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0.
Why this is correct
Azure first selects the most specific matching prefix. The destination 10.50.18.25 falls inside the /20 peering route, which is more specific than the 0.0.0.0/0 forced-tunneling route. Because the longest prefix wins, traffic is sent over the peering path rather than to the NVA or the internet.
Related concept
Longest prefix match
- ✗
None, because Azure disables routing when a subnet has both peering and a UDR.
Why it's wrong here
Azure does not disable routing in this situation. It evaluates available routes and applies the route selection rules normally.
When this WOULD be correct
This option would be correct if the subnet had a UDR that conflicts with a peering route and Azure explicitly blocked routing to prevent loops or ambiguity. For example, in a scenario where a forced tunneling UDR (0.0.0.0/0) and a peering route overlap, Azure might disable routing for that specific traffic and drop packets.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0.Correct answer▾
Why this is correct
Azure first selects the most specific matching prefix. The destination 10.50.18.25 falls inside the /20 peering route, which is more specific than the 0.0.0.0/0 forced-tunneling route. Because the longest prefix wins, traffic is sent over the peering path rather than to the NVA or the internet.
✗Internet, because the default route overrides more specific routes.Wrong answer — click to see why▾
Why this is wrong here
Azure uses the most specific route match (longest prefix). The peering route for 10.50.16.0/20 is more specific than the 0.0.0.0/0 UDR, so the default route does not override it.
★ When this WOULD be the correct answer
If the destination IP were outside the peering range and no other specific route existed, the 0.0.0.0/0 UDR would send traffic to the NVA. For example, a VM sending to 8.8.8.8 would use the default route.
Why candidates choose this
Candidates may mistakenly believe that a default route (0.0.0.0/0) always takes precedence over all other routes, ignoring the longest prefix match rule.
✗Network virtual appliance at 10.1.0.4, because user-defined routes always win over system routes.Wrong answer — click to see why▾
Why this is wrong here
User-defined routes do not always win over system routes; Azure uses the most specific route match. Here, the peering route for 10.50.16.0/20 is more specific than the 0.0.0.0/0 UDR, so the NVA is not used.
★ When this WOULD be the correct answer
If the destination IP fell within the UDR's address prefix (e.g., 0.0.0.0/0) and no more specific route existed, the UDR would be used. For example, a subnet with a UDR for 0.0.0.0/0 to an NVA and no peering or other specific routes for the destination.
Why candidates choose this
Candidates often overgeneralize that UDRs override system routes, forgetting that route selection is based on longest prefix match, not route type priority.
✗None, because Azure disables routing when a subnet has both peering and a UDR.Wrong answer — click to see why▾
Why this is wrong here
Azure does not disable routing when both peering and a UDR exist; instead, it uses the most specific route. The VM's traffic to 10.50.18.25 matches the peering route (10.50.16.0/20) which is more specific than the 0.0.0.0/0 UDR, so peering is used.
★ When this WOULD be the correct answer
This option would be correct if the subnet had a UDR that conflicts with a peering route and Azure explicitly blocked routing to prevent loops or ambiguity. For example, in a scenario where a forced tunneling UDR (0.0.0.0/0) and a peering route overlap, Azure might disable routing for that specific traffic and drop packets.
Why candidates choose this
Candidates may mistakenly think that conflicting routes cause Azure to disable routing entirely, rather than understanding that Azure selects the most specific route and continues forwarding.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume user-defined routes always override system routes, but Azure uses longest prefix match first, so a more specific system route (like a peering route) will take precedence over a less specific UDR.
Trap categories for this question
Scenario analysis trap
Azure does not disable routing in this situation. It evaluates available routes and applies the route selection rules normally.
Detailed technical explanation
How to think about this question
Azure routing uses the longest prefix match algorithm, where a /20 route (10.50.16.0/20) is more specific than a /0 route (0.0.0.0/0). Even though the UDR is user-defined, the system route for peering has a higher prefix length, so it wins. This behavior is consistent with RFC 4632 and applies regardless of route source (system, UDR, or BGP).
KKey Concepts to Remember
- Longest prefix match
- Virtual network peering system routes
- Default route 0.0.0.0/0
- User-defined route (UDR) precedence
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Longest prefix match
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
Visual reference
What to study next
Got this wrong? Here's your next step.
Review longest prefix match, then practise related AZ-104 questions on the same topic to reinforce the concept.
- →
Implement and Manage Virtual Networking — study guide chapter
Learn the concepts, then practise the questions
- →
Implement and Manage Virtual Networking practice questions
Targeted practice on this topic area only
- →
All AZ-104 questions
1,170 questions across all exam domains
- →
AZ-104 study guide
Full concept coverage aligned to exam objectives
- →
AZ-104 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-104 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Manage Azure Identities and Governance practice questions
Practise AZ-104 questions linked to Manage Azure Identities and Governance.
Implement and Manage Storage practice questions
Practise AZ-104 questions linked to Implement and Manage Storage.
Deploy and Manage Azure Compute practice questions
Practise AZ-104 questions linked to Deploy and Manage Azure Compute.
Implement and Manage Virtual Networking practice questions
Practise AZ-104 questions linked to Implement and Manage Virtual Networking.
Monitor and Maintain Azure Resources practice questions
Practise AZ-104 questions linked to Monitor and Maintain Azure Resources.
AZ-104 Azure RBAC practice questions
Practise AZ-104 questions linked to AZ-104 Azure RBAC.
AZ-104 storage account practice questions
Practise AZ-104 questions linked to AZ-104 storage account.
AZ-104 virtual network practice questions
Practise AZ-104 questions linked to AZ-104 virtual network.
AZ-104 NSG practice questions
Practise AZ-104 questions linked to AZ-104 NSG.
AZ-104 Azure Monitor practice questions
Practise AZ-104 questions linked to AZ-104 Azure Monitor.
AZ-104 backup practice questions
Practise AZ-104 questions linked to AZ-104 backup.
AZ-104 managed identity practice questions
Practise AZ-104 questions linked to AZ-104 managed identity.
Practice this exam
Start a free AZ-104 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-104 question test?
Implement and Manage Virtual Networking — This question tests Implement and Manage Virtual Networking — Longest prefix match.
What is the correct answer to this question?
The correct answer is: Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0. — Azure uses the most specific route (longest prefix match) to determine next hop. The destination 10.50.18.25 falls within the 10.50.16.0/20 range of the peering route, which is more specific than the 0.0.0.0/0 UDR. Therefore, the traffic is routed via the virtual network peering, not the NVA.
What should I do if I get this AZ-104 question wrong?
Review longest prefix match, then practise related AZ-104 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Longest prefix match
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A route table on a subnet contains this user-defined route: - 0.0.0.0/0 -> Virtual appliance 10.0.0.4 The subnet is peered to another VNet with address space 10.2.0.0/16. A VM in the subnet sends traffic to 10.2.2.7, and Network Watcher shows the next hop as Virtual network peering instead of the appliance. What explains this result?
medium- A.User-defined routes never apply to peered networks.
- ✓ B.The peering route is more specific than the default route, so it is selected first.
- C.NSG rules always override any route table entry.
- D.Peering only works when both VNets are in the same region.
Why B: Azure uses the longest prefix match to determine the next hop for traffic. The user-defined route (UDR) for 0.0.0.0/0 is a default route, while the peering route for 10.2.0.0/16 is more specific. Since 10.2.2.7 falls within the 10.2.0.0/16 range, the peering route is preferred over the default route, directing traffic through the VNet peering instead of the virtual appliance.
Variation 2. A route table contains these entries: 10.0.0.0/8 with next hop Virtual appliance, and 10.1.1.0/24 with next hop Virtual network gateway. Which next hop will Azure use for traffic to 10.1.1.5?
medium- A.Virtual appliance, because the broader 10.0.0.0/8 route was created first.
- ✓ B.Virtual network gateway, because the /24 route is more specific than the /8 route.
- C.Internet, because Azure always prefers the default system route for public addresses.
- D.None, because Azure ignores overlapping route entries in the same table.
Why B: Azure uses the most specific route prefix (longest prefix match) to determine the next hop for traffic. For destination 10.1.1.5, the route 10.1.1.0/24 (prefix length 24) is more specific than 10.0.0.0/8 (prefix length 8), so the next hop Virtual network gateway is selected, regardless of the order in which routes were created.
Variation 3. A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?
medium- A.Remove the default route so all traffic uses the system routes.
- ✓ B.Add a more specific /32 route for 40.90.10.25 with next hop type Internet.
- C.Create a service endpoint for the server and the update site.
- D.Attach a NAT gateway to the subnet so the server can bypass the firewall.
Why B: Option B is correct because adding a more specific /32 route for 40.90.10.25 with next hop type Internet overrides the default route (0.0.0.0/0) for traffic destined to that specific IP. User-defined routes (UDRs) follow the longest prefix match principle, so the /32 route takes precedence over the /0 route, allowing the server to reach the update site directly via the internet while all other outbound traffic continues through the firewall appliance.
Variation 4. A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?
medium- A.Azure always ignores user-defined routes for storage traffic.
- ✓ B.The storage account traffic is using a more specific route than the 0.0.0.0/0 route.
- C.NSG outbound rules override user-defined routes in Azure.
- D.The subnet needs a public IP address assigned to each VM for the route to take effect.
Why B: The most likely reason is that the storage account traffic is using a more specific route than the 0.0.0.0/0 route. Azure uses longest prefix match routing, so a route with a smaller prefix (e.g., a specific public IP range for Azure Storage) will take precedence over the default route. The 0.0.0.0/0 route only applies when no more specific route exists, and Azure automatically adds platform routes for Azure services like Storage, which can override user-defined routes.
Variation 5. A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a virtual appliance. Traffic to 10.20.4.12 must instead go directly to an Azure VPN gateway. What should you configure?
medium- A.Add a network security group rule that allows traffic to 10.20.4.12.
- ✓ B.Add a more specific UDR for 10.20.4.0/24 that uses the virtual network gateway next hop.
- C.Increase the priority of the 0.0.0.0/0 route so it is preferred less often.
- D.Remove the VPN gateway association from the virtual network.
Why B: Option B is correct because User-Defined Routes (UDRs) use the longest prefix match to determine the next hop. The existing 0.0.0.0/0 route sends all outbound traffic to a virtual appliance, but adding a more specific route for 10.20.4.0/24 with a next hop of the virtual network gateway (VPN gateway) overrides the default route for that subnet, directing traffic to 10.20.4.12 through the VPN gateway.
Keep practising
More AZ-104 practice questions
- A storage automation service principal must upload, read, and delete blob data in one container by using Microsoft Entra…
- A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Su…
- A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that…
- Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue…
- An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or cl…
- A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in anoth…
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.