AZ-104 Implement and Manage Virtual Networking Practice Question
A VM has both a default route from a VPN gateway and a user-defined route to an on-premises firewall. Traffic is still not reaching the expected next hop. The administrator wants to see the exact routes currently applied to the VM NIC. Which tool should be used?
⚠ Common exam trap
Many candidates confuse 'IP flow verify' (which tests connectivity) with 'Effective routes' (which shows the routing table), leading them to choose IP flow verify when the real need is to inspect the actual route selection logic applied to the NIC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Effective routes
Effective routes is the correct tool because it displays the actual, consolidated routing table applied to a specific network interface, including user-defined routes (UDRs), BGP routes from the VPN gateway, and system default routes. When traffic fails to reach the expected next hop despite having both a VPN default route and a UDR, the administrator must verify which route is actually active and has the highest priority (based on prefix length and route preference). Effective routes shows the exact next-hop IP and route source for each prefix, allowing the administrator to confirm whether the UDR to the on-premises firewall is being honored or overridden.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Effective routes
Why this is correct
Effective routes show the actual routing table that Azure applies to a VM NIC, including system routes, UDRs, and routes learned from gateways. This is the best way to verify which next hop will be used after route selection logic is applied. It is especially helpful when a VPN gateway, UDR, or default Azure route creates an unexpected path and the administrator needs the exact active result rather than the intended configuration.
- ✗
IP flow verify
Why it's wrong here
IP flow verify is an NSG diagnostic that simulates a packet and checks whether it is allowed or denied by network security group rules. It does not inspect or display the routing table, so it cannot show whether the VPN gateway or a user-defined route provides the actual next hop. It validates security rules, not the effective route selection logic.
When this WOULD be correct
IP flow verify would be correct if the question asked: 'A VM cannot communicate with an on-premises server. The administrator suspects a network security group is blocking traffic. Which tool should be used to test connectivity and identify blocking rules?'
- ✗
Packet capture
Why it's wrong here
Packet capture records raw network traffic on a VM NIC, capturing packets that are actually transmitted and received. While it can show that traffic is leaving or arriving, it does not expose the Azure route selection decision or the next hop type applied to the NIC. Effective routes are separate configuration state that packet capture cannot display.
When this WOULD be correct
Packet capture would be correct when the question asks to analyze network traffic to diagnose connectivity issues, such as capturing packets to see if traffic is being sent to the correct next hop or to inspect packet contents for security or performance analysis.
- ✗
Connection troubleshoot
Why it's wrong here
Connection troubleshoot performs an end-to-end reachability test to a specific destination and reports failure reasons, including route issues. It is a point-in-time connectivity test rather than a complete route table viewer, so it cannot enumerate all active routes or show the effective next-hop for every prefix. For verifying a UDR and VPN gateway route conflict, you need the full effective route list.
When this WOULD be correct
Connection troubleshoot would be correct when the question asks to diagnose why a VM cannot connect to a specific IP address or port, and you need to test end-to-end connectivity including network security group rules and routing.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Effective routesCorrect answer▾
Why this is correct
Effective routes show the actual routing table that Azure applies to a VM NIC, including system routes, UDRs, and routes learned from gateways. This is the best way to verify which next hop will be used after route selection logic is applied. It is especially helpful when a VPN gateway, UDR, or default Azure route creates an unexpected path and the administrator needs the exact active result rather than the intended configuration.
✗IP flow verifyWrong answer — click to see why▾
Why this is wrong here
IP flow verify checks if traffic is allowed or denied based on NSG rules, but it does not show the effective routes applied to a VM NIC. The question asks for the exact routes, not security rule validation.
★ When this WOULD be the correct answer
IP flow verify would be correct if the question asked: 'A VM cannot communicate with an on-premises server. The administrator suspects a network security group is blocking traffic. Which tool should be used to test connectivity and identify blocking rules?'
Why candidates choose this
Candidates may confuse IP flow verify with effective routes because both are used for network troubleshooting, but IP flow verify focuses on NSG rules, not routing tables.
✗Packet captureWrong answer — click to see why▾
Why this is wrong here
Packet capture captures network traffic for analysis, but it does not show the routes applied to a VM NIC. The question asks for the exact routes currently applied, which is provided by effective routes, not packet capture.
★ When this WOULD be the correct answer
Packet capture would be correct when the question asks to analyze network traffic to diagnose connectivity issues, such as capturing packets to see if traffic is being sent to the correct next hop or to inspect packet contents for security or performance analysis.
Why candidates choose this
Candidates may think packet capture can reveal routing by inspecting packet headers, but it only shows actual traffic, not the routing table or effective routes applied to the NIC.
✗Connection troubleshootWrong answer — click to see why▾
Why this is wrong here
Connection troubleshoot is used to test connectivity between a VM and another endpoint, not to display the exact routes applied to a VM NIC. The question asks for a tool to view current routes, which is the purpose of Effective routes.
★ When this WOULD be the correct answer
Connection troubleshoot would be correct when the question asks to diagnose why a VM cannot connect to a specific IP address or port, and you need to test end-to-end connectivity including network security group rules and routing.
Why candidates choose this
Candidates may confuse 'troubleshoot' with 'view routes', assuming that a connectivity troubleshooting tool would also show routing information, or they may think that testing connectivity implicitly reveals routing issues.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.