AZ-104 Implement and Manage Virtual Networking Practice Question
Which two statements about Azure route tables and user-defined routes are correct? Select two.
⚠ Common exam trap
Candidates often confuse the scope of route table association (subnet vs. VM) and assume UDRs can override NSG rules, when in fact routing and firewall filtering are separate layers in Azure's networking stack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
You can associate a route table with a subnet.
Route tables in Azure are associated at the subnet level, not directly to a virtual machine. This association allows the route table's user-defined routes (UDRs) to override system default routes for traffic leaving that subnet. The subnet must be in the same region as the route table, and a single route table can be associated with multiple subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
You can associate a route table with a subnet.
Why this is correct
A route table is a top-level Azure resource that must be linked to one or more subnets. After the association, all VMs in that subnet automatically use the route table's user-defined routes, and the route table cannot be attached to a VM's network interface directly. This design allows consistent routing for all resources in the subnet but means you cannot isolate one VM's routes without creating a separate subnet.
- ✓
A user-defined route can send traffic to a virtual appliance as the next hop.
Why this is correct
When you create a user-defined route, you can select 'Virtual appliance' as the next hop type and specify the private IP address of a VM or another network device. The appliance must have IP forwarding enabled, otherwise Azure will not deliver the packets to it. This is the standard pattern for forced tunneling and traffic inspection in Azure.
- ✗
Route tables can be associated directly to a single virtual machine without using its subnet.
Why it's wrong here
Route tables cannot be associated directly to a single virtual machine. Azure only permits the association of a route table to a subnet, and every VM in that subnet shares the same effective routes. If you need different routing for a specific VM, you must create a separate subnet with its own route table and place the VM there, rather than attaching the table to the VM.
When this WOULD be correct
In a scenario where the question asks about associating a network security group (NSG) directly to a VM's network interface, that would be correct. For example: 'You can associate a network security group directly to a virtual machine's network interface.'
- ✗
A user-defined route automatically overrides a network security group deny rule.
Why it's wrong here
User-defined routes govern the next hop for packets, while network security groups enforce allow/deny rules on traffic. A UDR cannot change the outcome of an NSG deny; if an NSG rule denies traffic, the traffic is dropped before it can be routed to the next hop. The two must be designed together, but routing never overrides security filtering.
When this WOULD be correct
In a scenario where the question asks about the precedence of route types, and an option states 'A user-defined route can override a system route for the same destination prefix.' This would be correct because UDRs have higher precedence than system routes.
- ✗
System routes are never used when a route table exists.
Why it's wrong here
System routes, such as those for local virtual network traffic, internet-bound traffic, and gateway connections, are always present and evaluated alongside user-defined routes. Azure uses prefix matching to choose the most specific route; if no UDR matches a destination, the associated system route is still used. UDRs can only override system routes that have a matching prefix, and some system routes, like the local VNet route, can be overridden but not deleted entirely.
When this WOULD be correct
If the question asked 'Which statement about route priority is correct?' and the options included 'System routes are never used when a user-defined route is applied to the same traffic,' then this could be correct because UDRs take precedence over system routes for matching traffic.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓You can associate a route table with a subnet.Correct answer▾
Why this is correct
A route table is a top-level Azure resource that must be linked to one or more subnets. After the association, all VMs in that subnet automatically use the route table's user-defined routes, and the route table cannot be attached to a VM's network interface directly. This design allows consistent routing for all resources in the subnet but means you cannot isolate one VM's routes without creating a separate subnet.
✗Route tables can be associated directly to a single virtual machine without using its subnet.Wrong answer — click to see why▾
Why this is wrong here
Route tables are associated with subnets, not directly with individual virtual machines. A VM inherits routes from its subnet's route table.
★ When this WOULD be the correct answer
In a scenario where the question asks about associating a network security group (NSG) directly to a VM's network interface, that would be correct. For example: 'You can associate a network security group directly to a virtual machine's network interface.'
Why candidates choose this
Candidates may confuse route tables with network security groups (NSGs), which can be associated directly to a VM's NIC, or think that route tables can be applied per-VM for granular control.
✗A user-defined route automatically overrides a network security group deny rule.Wrong answer — click to see why▾
Why this is wrong here
User-defined routes (UDRs) control network traffic routing, not security filtering. Network security group (NSG) rules are evaluated after routing, and a UDR cannot override an NSG deny rule because they operate at different layers: routing determines the path, NSG rules allow or deny traffic.
★ When this WOULD be the correct answer
In a scenario where the question asks about the precedence of route types, and an option states 'A user-defined route can override a system route for the same destination prefix.' This would be correct because UDRs have higher precedence than system routes.
Why candidates choose this
Candidates may confuse the functions of routing and security, thinking that a route can bypass security rules, or they may misinterpret 'override' as simply taking precedence over system routes, not NSG rules.
✗System routes are never used when a route table exists.Wrong answer — click to see why▾
Why this is wrong here
System routes are always used by default; user-defined routes (UDRs) override system routes only for specific traffic, but system routes still apply for other traffic and are not completely ignored when a route table exists.
★ When this WOULD be the correct answer
If the question asked 'Which statement about route priority is correct?' and the options included 'System routes are never used when a user-defined route is applied to the same traffic,' then this could be correct because UDRs take precedence over system routes for matching traffic.
Why candidates choose this
Candidates may mistakenly think that associating a route table with a subnet completely replaces system routes, not realizing that system routes still apply for traffic not covered by UDRs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.