AZ-104 Implement and Manage Virtual Networking Practice Question
Traffic from VM-App01 is taking an unexpected path to the internet through a network virtual appliance. You need to determine which routes are actually applied to the VM network interface. Which Azure feature should you use?
⚠ Common exam trap
Test-takers frequently confuse 'effective routes' with 'NSG flow logs' because both involve network troubleshooting, but effective routes solve routing-path issues while flow logs solve firewall/security-rule issues.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Effective routes for the network interface
Effective routes for a network interface show the actual routes applied to the VM's NIC after combining all route sources (system routes, BGP, and user-defined routes). This allows you to verify whether traffic is being forced through the NVA or taking an unexpected path, by inspecting the next hop type and IP address for the 0.0.0.0/0 route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Effective routes for the network interface
Why this is correct
Effective routes for the network interface provide the exact routing table entries that are actively applied to a specific NIC, including system routes, user-defined routes (UDRs), and routes learned via BGP. This blade directly shows the next-hop type and IP for each destination prefix, making it the definitive tool to diagnose why traffic from VM app01 is taking an unexpected path. For example, if a forced-tunneling route or a custom route to a network virtual appliance is misconfigured, it will appear here.
- ✗
NSG flow logs
Why it's wrong here
NSG flow logs record every accepted or denied IP flow by an NSG, including source/destination IP, port, and the allow/deny decision. They reveal whether security rules are permitting or blocking traffic, but they do not display the route table, next-hop address, or route selection logic applied to the NIC. Thus, flow logs cannot show why a packet takes a particular network path; they only indicate if the packet survived NSG filtering at the subnet/NIC layer.
When this WOULD be correct
When you need to analyze traffic patterns, detect anomalies, or troubleshoot connectivity issues through NSGs, such as verifying whether a specific connection is allowed or denied by NSG rules.
- ✗
Azure Policy compliance
Why it's wrong here
Azure Policy compliance assesses Azure resources for adherence to policy definitions, such as enforcing tag requirements or restricting resource SKUs, and the results are visible in the Compliance blade. Policy compliance does not generate runtime network diagnostics and has no visibility into the effective next-hop or route table of a NIC. It is a control-plane configuration audit, not a data-plane path troubleshooting tool.
When this WOULD be correct
When a question asks how to enforce or audit that all VMs in a subscription have a specific tag or use a particular SKU, Azure Policy compliance would be the correct feature to use.
- ✗
The subscription activity log
Why it's wrong here
The subscription activity log records control-plane events such as creating, updating, or deleting resources, as well as operational events like starting/stopping a VM. It does not capture data-plane traffic behavior, route configuration, or the current effective route list for a NIC. While it may show when a route table was modified, it cannot explain the live routing decision currently made for VM app01's traffic.
When this WOULD be correct
You need to investigate who deleted a critical virtual network or changed a route table in the last 24 hours. The subscription activity log would show the user, timestamp, and details of the management operation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Effective routes for the network interfaceCorrect answer▾
Why this is correct
Effective routes for the network interface provide the exact routing table entries that are actively applied to a specific NIC, including system routes, user-defined routes (UDRs), and routes learned via BGP. This blade directly shows the next-hop type and IP for each destination prefix, making it the definitive tool to diagnose why traffic from VM app01 is taking an unexpected path. For example, if a forced-tunneling route or a custom route to a network virtual appliance is misconfigured, it will appear here.
✗NSG flow logsWrong answer — click to see why▾
Why this is wrong here
NSG flow logs show traffic flows through NSGs, not the actual routes applied to a VM's network interface. They cannot reveal which routes are effective for the VM.
★ When this WOULD be the correct answer
When you need to analyze traffic patterns, detect anomalies, or troubleshoot connectivity issues through NSGs, such as verifying whether a specific connection is allowed or denied by NSG rules.
Why candidates choose this
Candidates may confuse flow logs with route analysis, thinking logs can show the path traffic takes, but they only show NSG-level decisions, not routing table entries.
✗Azure Policy complianceWrong answer — click to see why▾
Why this is wrong here
Azure Policy compliance evaluates resource configurations against policy rules, not actual applied routes. It cannot show which routes are effective on a VM's network interface.
★ When this WOULD be the correct answer
When a question asks how to enforce or audit that all VMs in a subscription have a specific tag or use a particular SKU, Azure Policy compliance would be the correct feature to use.
Why candidates choose this
Candidates may confuse policy compliance with network route validation, thinking that policies can enforce or verify routing behavior, but policies do not inspect effective routes.
✗The subscription activity logWrong answer — click to see why▾
Why this is wrong here
The subscription activity log records management-plane operations (e.g., creating or deleting resources), not data-plane routing information for a specific VM network interface. It cannot show which routes are actually applied to the VM's NIC.
★ When this WOULD be the correct answer
You need to investigate who deleted a critical virtual network or changed a route table in the last 24 hours. The subscription activity log would show the user, timestamp, and details of the management operation.
Why candidates choose this
Candidates may think the activity log contains all events related to a resource, including routing changes, but it only captures control-plane actions, not the effective data-plane route state.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.