AZ-104 Implement and Manage Virtual Networking Practice Question
Traffic from VM-App01 is unexpectedly reaching the internet through a network virtual appliance. You need to determine which route is currently applied to the virtual machine network interface. Which Azure tool should you use?
⚠ Common exam trap
Test-takers frequently confuse network security group (NSG) flow logs with routing diagnostics, but NSG flow logs only show traffic filtering decisions, not the path traffic takes based on routes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Effective routes for the network interface
Effective routes for the network interface show the actual routes applied to a VM's NIC, including system routes, BGP routes, and user-defined routes (UDRs). Since traffic is unexpectedly reaching the internet through an NVA, you need to verify which route (e.g., a UDR with next hop type VirtualAppliance) is currently active. This tool directly displays the effective route table for the specific NIC, allowing you to identify the misconfigured route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Effective routes for the network interface
Why this is correct
Effective routes for the network interface display the complete, evaluated routing table applied to app01's NIC, including system routes, BGP routes, and any user-defined routes (UDRs) from the subnet. Because unexpected internet traffic is a data-plane forwarding problem, this view directly reveals which 0.0.0.0/0 next-hop rule is active and whether a UDR's next hop is valid or has fallen back to the system internet route. Checking effective routes is the definitive way to confirm the actual path chosen for outbound traffic.
- ✗
NSG flow logs
Why it's wrong here
NSG flow logs record connection-level decisions made by network security group rules, such as whether a packet was allowed or denied at the NIC or subnet boundary. These logs do not show the route table next hop, the active 0.0.0.0/0 route, or the underlying IP forwarding selection, so they cannot explain why traffic is being sent toward an internet next hop. They reveal only that traffic was permitted, not which routing entry caused it to leave the intended network path.
When this WOULD be correct
When you need to analyze network traffic patterns to identify whether traffic is being allowed or blocked by NSG rules, or to troubleshoot connectivity issues related to NSG rules. For example: 'Users report that VM-App01 cannot connect to the internet. Which tool should you use to see if traffic is being denied by an NSG?'
- ✗
Azure Advisor recommendations
Why it's wrong here
Azure Advisor provides proactive best-practice recommendations across high availability, security, performance, and cost by analyzing telemetry and configurations. It does not expose per-NIC effective route tables or next-hop addresses, and its recommendations are aggregated, cost-focused, or security-focused rather than providing real-time data-plane diagnostics for a single VM. As a result, Advisor cannot pinpoint the active 0.0.0.0/0 route or other routing entries that would explain unexpected outbound internet connectivity.
When this WOULD be correct
You need to identify if a virtual machine is missing a critical security update or has a configuration that could lead to a security vulnerability. Azure Advisor would analyze the VM's configuration and provide security recommendations.
- ✗
Diagnostic settings for the activity log
Why it's wrong here
Diagnostic settings for the activity log control the export of platform-level audit events like resource creation, deletion, or configuration changes to Log Analytics, Event Hub, or Storage. Activity logs are control-plane operations that describe who made changes and when, but they contain no data-plane packet forwarding information or current route evaluation state. Therefore, enabling them would capture attempts to modify a route table or NSG, but it would not show the effective route entries currently applied to app01's NIC.
When this WOULD be correct
You need to audit who deleted a virtual network or changed a route table. Diagnostic settings for the activity log would capture these management events and send them to a Log Analytics workspace or storage account.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Effective routes for the network interfaceCorrect answer▾
Why this is correct
Effective routes for the network interface display the complete, evaluated routing table applied to app01's NIC, including system routes, BGP routes, and any user-defined routes (UDRs) from the subnet. Because unexpected internet traffic is a data-plane forwarding problem, this view directly reveals which 0.0.0.0/0 next-hop rule is active and whether a UDR's next hop is valid or has fallen back to the system internet route. Checking effective routes is the definitive way to confirm the actual path chosen for outbound traffic.
✗NSG flow logsWrong answer — click to see why▾
Why this is wrong here
NSG flow logs show traffic allowed or denied by network security groups, but they do not reveal which route (e.g., user-defined route) is applied to a network interface. The question asks for the currently applied route, not traffic flow logs.
★ When this WOULD be the correct answer
When you need to analyze network traffic patterns to identify whether traffic is being allowed or blocked by NSG rules, or to troubleshoot connectivity issues related to NSG rules. For example: 'Users report that VM-App01 cannot connect to the internet. Which tool should you use to see if traffic is being denied by an NSG?'
Why candidates choose this
Candidates may confuse NSG flow logs with route analysis because both involve network troubleshooting, and flow logs provide detailed traffic data that might indirectly hint at routing issues, but they do not show the effective route table.
✗Azure Advisor recommendationsWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides recommendations for best practices (e.g., cost, security, reliability), but it does not show the actual applied routes on a network interface. To determine which route is currently applied, you need to view effective routes, which are specific to the NIC.
★ When this WOULD be the correct answer
You need to identify if a virtual machine is missing a critical security update or has a configuration that could lead to a security vulnerability. Azure Advisor would analyze the VM's configuration and provide security recommendations.
Why candidates choose this
Candidates may think Azure Advisor can diagnose network routing issues because it offers recommendations for various Azure resources, but it does not provide real-time routing information.
✗Diagnostic settings for the activity logWrong answer — click to see why▾
Why this is wrong here
Diagnostic settings for the activity log capture control-plane operations (e.g., resource creation or deletion), not data-plane traffic routing. They cannot show which route is applied to a VM's network interface.
★ When this WOULD be the correct answer
You need to audit who deleted a virtual network or changed a route table. Diagnostic settings for the activity log would capture these management events and send them to a Log Analytics workspace or storage account.
Why candidates choose this
Candidates may confuse 'diagnostic settings' with network diagnostics, or think activity logs include all network events, not realizing they only cover management operations.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
UDR
UDR is a user-defined routing rule that controls how network traffic moves between subnets or to external destinations in a cloud or on-premises environment.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Traffic from VM-App01 is taking an unexpected path to the internet through a network virtual appliance. You need to determine which routes are actually applied to the VM network interface. Which Azure feature should you use?
hard- ✓ A.Effective routes for the network interface
- B.NSG flow logs
- C.Azure Policy compliance
- D.The subscription activity log
Why A: Effective routes for a network interface show the actual routes applied to the VM's NIC after combining all route sources (system routes, BGP, and user-defined routes). This allows you to verify whether traffic is being forced through the NVA or taking an unexpected path, by inspecting the next hop type and IP address for the 0.0.0.0/0 route.
Variation 2. Traffic from VM-App01 is unexpectedly reaching the internet through a virtual appliance. You need to see which routes are currently applied to the VM network interface. Which Azure tool should you use?
hard- ✓ A.Effective routes for the network interface
- B.NSG flow logs
- C.Azure Policy compliance
- D.Activity log
Why A: Effective routes for the network interface shows the actual, evaluated routes applied to a specific VM NIC, including system routes, BGP-advertised routes, and user-defined routes (UDRs). This tool resolves the order of route preference (longest prefix match) and confirms whether traffic is being forced through a virtual appliance (e.g., via a UDR with next hop type VirtualAppliance). It directly answers why VM-App01's traffic is reaching the internet unexpectedly.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.