Override Default Route for Specific IP with More Specific Route
A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?
Quick Answer
The answer is to add a more specific /32 route for 40.90.10.25 with next hop type Internet. This works because user-defined routes (UDRs) follow the longest prefix match principle, meaning a /32 route is more specific than the 0.0.0.0/0 default route and will take precedence for traffic destined to that exact IP address. On the AZ-104 exam, this scenario tests your understanding of route prioritization and how to override a default route for a specific IP without disrupting other traffic. A common trap is thinking you need to modify or remove the existing 0.0.0.0/0 route, but that would break all other outbound traffic; instead, you simply add a narrower route. Remember the memory tip: "The more bits in the mask, the more specific the path"—a /32 always beats a /0.
⚠ Common exam trap
It's easy for candidates to think a NAT gateway or service endpoint can bypass a firewall for specific traffic, but they fail to understand that route precedence (longest prefix match) is the only way to override a default route for a specific destination in Azure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a more specific /32 route for 40.90.10.25 with next hop type Internet.
Adding a more specific /32 route for 40.90.10.25 with next hop type Internet overrides the default route (0.0.0.0/0) for traffic destined to that specific IP. User-defined routes (UDRs) follow the longest prefix match principle, so the /32 route takes precedence over the /0 route, allowing the server to reach the update site directly via the internet while all other outbound traffic continues through the firewall appliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the default route so all traffic uses the system routes.
Why it's wrong here
Removing the default route would send all outbound traffic away from the firewall, not just one destination.
When this WOULD be correct
This option would be correct if the requirement were to allow all outbound traffic to use system routes (i.e., direct internet access) without any firewall inspection, and there was no need to route specific traffic through a firewall. For example, if the question stated: 'All servers in the subnet must have direct internet access; remove any forced tunneling.'
- ✓
Add a more specific /32 route for 40.90.10.25 with next hop type Internet.
Why this is correct
Azure uses longest-prefix matching when selecting routes. A specific /32 route for one destination is more specific than the broader 0.0.0.0/0 forced-tunnel route, so traffic to that IP can bypass the firewall and go directly to the Internet. This is the cleanest way to create a targeted exception without changing the behavior for all other outbound traffic from the subnet.
- ✗
Create a service endpoint for the server and the update site.
Why it's wrong here
Service endpoints apply to supported Azure PaaS services, not arbitrary Internet IP addresses.
When this WOULD be correct
If the question required a server in a subnet to securely access an Azure service (e.g., Azure Storage or SQL Database) without going through a firewall or internet, a service endpoint would be the correct answer. For example: 'A subnet routes all traffic through a firewall. A server needs to access Azure Storage directly. What should you configure?'
- ✗
Attach a NAT gateway to the subnet so the server can bypass the firewall.
Why it's wrong here
A NAT gateway changes outbound source addressing, but it does not override a UDR to a firewall appliance.
When this WOULD be correct
If the requirement were to provide outbound internet access to all servers in the subnet while hiding their private IPs, and the firewall was not needed, attaching a NAT gateway would be correct. For example, in a scenario where the subnet must access the internet without a firewall, a NAT gateway is the appropriate solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add a more specific /32 route for 40.90.10.25 with next hop type Internet.Correct answer▾
Why this is correct
Azure uses longest-prefix matching when selecting routes. A specific /32 route for one destination is more specific than the broader 0.0.0.0/0 forced-tunnel route, so traffic to that IP can bypass the firewall and go directly to the Internet. This is the cleanest way to create a targeted exception without changing the behavior for all other outbound traffic from the subnet.
✗Remove the default route so all traffic uses the system routes.Wrong answer — click to see why▾
Why this is wrong here
Removing the default route would cause all outbound traffic, including the server's update traffic, to use system routes, which would not route through the firewall but also would not allow the server to directly reach 40.90.10.25 without a specific route. This fails to meet the requirement that only the server's traffic to 40.90.10.25 bypasses the firewall.
★ When this WOULD be the correct answer
This option would be correct if the requirement were to allow all outbound traffic to use system routes (i.e., direct internet access) without any firewall inspection, and there was no need to route specific traffic through a firewall. For example, if the question stated: 'All servers in the subnet must have direct internet access; remove any forced tunneling.'
Why candidates choose this
Candidates may think that removing the default route will allow the server to access the internet directly, but they overlook that the default route is needed for general internet access and that a more specific route is required to bypass the firewall for a specific destination.
✗Create a service endpoint for the server and the update site.Wrong answer — click to see why▾
Why this is wrong here
A service endpoint does not bypass the firewall; it only provides direct connectivity to Azure services over the Azure backbone, not to a specific public IP like 40.90.10.25. The requirement is to allow direct internet access for a specific IP, which service endpoints cannot achieve.
★ When this WOULD be the correct answer
If the question required a server in a subnet to securely access an Azure service (e.g., Azure Storage or SQL Database) without going through a firewall or internet, a service endpoint would be the correct answer. For example: 'A subnet routes all traffic through a firewall. A server needs to access Azure Storage directly. What should you configure?'
Why candidates choose this
Candidates may confuse service endpoints with a method to bypass routing policies, thinking they provide direct internet access for specific services, when in fact they only optimize connectivity to Azure services and do not override user-defined routes.
✗Attach a NAT gateway to the subnet so the server can bypass the firewall.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet access with source network address translation, but it does not allow selective bypass of the firewall for specific destinations; all traffic would still follow the UDR unless a more specific route is added.
★ When this WOULD be the correct answer
If the requirement were to provide outbound internet access to all servers in the subnet while hiding their private IPs, and the firewall was not needed, attaching a NAT gateway would be correct. For example, in a scenario where the subnet must access the internet without a firewall, a NAT gateway is the appropriate solution.
Why candidates choose this
Candidates may think a NAT gateway can be used to route specific traffic directly to the internet, but they overlook that the UDR still applies to all traffic unless overridden by a more specific route.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Securing Azure Storage (SAS, Keys, Firewall)
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Default route
A default route is a catch-all routing entry that tells a network device where to send packets when no specific route matches the destination address.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a virtual appliance. Traffic to 10.20.4.12 must instead go directly to an Azure VPN gateway. What should you configure?
medium- A.Add a network security group rule that allows traffic to 10.20.4.12.
- ✓ B.Add a more specific UDR for 10.20.4.0/24 that uses the virtual network gateway next hop.
- C.Increase the priority of the 0.0.0.0/0 route so it is preferred less often.
- D.Remove the VPN gateway association from the virtual network.
Why B: User-Defined Routes (UDRs) use the longest prefix match to determine the next hop. The existing 0.0.0.0/0 route sends all outbound traffic to a virtual appliance, but adding a more specific route for 10.20.4.0/24 with a next hop of the virtual network gateway (VPN gateway) overrides the default route for that subnet, directing traffic to 10.20.4.12 through the VPN gateway.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.