AZ-104 Implement and Manage Virtual Networking Practice Question
Your company deploys a network virtual appliance (NVA) in a hub subnet. All outbound internet traffic from Subnet-App in a spoke VNet must pass through the NVA for inspection. What should you configure on Subnet-App?
⚠ Common exam trap
Candidates often confuse a NAT gateway (which translates source IPs) with a route-based forced tunneling solution, or they assume a service endpoint can redirect traffic through an NVA, when in fact service endpoints bypass forced tunneling by design.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user-defined route with a next hop of Virtual Appliance
A user-defined route (UDR) with a next hop of Virtual Appliance forces all outbound traffic from Subnet-App to be forwarded to the NVA for inspection. This overrides Azure's default system route for 0.0.0.0/0, which normally sends internet-bound traffic directly to the internet. By specifying the NVA's private IP as the next hop, you ensure traffic is routed through the hub subnet for inspection before leaving the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A private DNS zone
Why it's wrong here
A private DNS zone is used to resolve custom domain names to private IP addresses within a virtual network. It affects name resolution only, not the path that network packets take after the IP address is obtained. Even if the DNS zone resolves a hostname to an IP, it does not insert the NVA into the forwarding path for that traffic. Thus, a private DNS zone cannot redirect internet-bound or inter-subnet traffic through the NVA for inspection.
When this WOULD be correct
When you need to resolve a custom domain name (e.g., contoso.com) to a private IP address within a VNet, you would create a private DNS zone and link it to the VNet.
- ✓
A user-defined route with a next hop of Virtual Appliance
Why this is correct
A user-defined route (UDR) with a next hop type of 'Virtual Appliance' is the correct way to force subnet traffic through an NVA. When the route table is associated with the spoke subnet, any traffic destined for the internet (or another network) is matched by the route and forwarded to the private IP address of the NVA. This enables the NVA to inspect, filter, and forward traffic as required. Without this explicit route, Azure's default routing would send traffic directly to the internet, bypassing the appliance.
- ✗
A service endpoint for Microsoft.Storage
Why it's wrong here
A service endpoint for Microsoft.Storage provides a direct, optimized connection from a virtual network subnet to Azure Storage, using the Azure backbone network. This only applies to traffic destined to the specific Azure service (Storage) and not to general internet-bound traffic. Service endpoints do not alter the routing for other types of traffic, nor do they force traffic through an NVA. Therefore, they cannot fulfill the requirement of steering all outgoing traffic through the appliance.
When this WOULD be correct
A service endpoint for Microsoft.Storage would be correct if the question asked: 'You need to ensure that traffic from Subnet-App to Azure Storage accounts uses the Azure backbone network instead of the public internet.' In that scenario, enabling a service endpoint on the subnet provides secure and optimized connectivity to Storage.
- ✗
A NAT gateway on the NVA subnet only
Why it's wrong here
A NAT gateway placed on the NVA subnet only provides outbound internet connectivity for resources within that specific subnet. It does not affect the routing of traffic from other subnets, such as the spoke subnet. Even if the NAT gateway were placed on the spoke subnet, it would simply translate the source IP for internet traffic but would not insert the NVA into the traffic path for inspection. Consequently, it does not redirect spoke subnet traffic through the NVA.
When this WOULD be correct
If the requirement is to provide outbound internet connectivity to a subnet with a single, predictable public IP address (e.g., for whitelisting), and no inspection is needed, you would configure a NAT gateway on the subnet or its route table.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user-defined route with a next hop of Virtual ApplianceCorrect answer▾
Why this is correct
A user-defined route (UDR) with a next hop type of 'Virtual Appliance' is the correct way to force subnet traffic through an NVA. When the route table is associated with the spoke subnet, any traffic destined for the internet (or another network) is matched by the route and forwarded to the private IP address of the NVA. This enables the NVA to inspect, filter, and forward traffic as required. Without this explicit route, Azure's default routing would send traffic directly to the internet, bypassing the appliance.
✗A private DNS zoneWrong answer — click to see why▾
Why this is wrong here
A private DNS zone resolves custom domain names within a VNet, not route traffic. It cannot force outbound traffic through an NVA.
★ When this WOULD be the correct answer
When you need to resolve a custom domain name (e.g., contoso.com) to a private IP address within a VNet, you would create a private DNS zone and link it to the VNet.
Why candidates choose this
Candidates may confuse DNS resolution with traffic routing, thinking a private DNS zone can redirect traffic to the NVA.
✗A service endpoint for Microsoft.StorageWrong answer — click to see why▾
Why this is wrong here
A service endpoint for Microsoft.Storage allows direct access to Azure Storage from a subnet without going through the internet, but it does not redirect or inspect outbound internet traffic. The requirement is to force all outbound traffic through the NVA, which requires a user-defined route, not a service endpoint.
★ When this WOULD be the correct answer
A service endpoint for Microsoft.Storage would be correct if the question asked: 'You need to ensure that traffic from Subnet-App to Azure Storage accounts uses the Azure backbone network instead of the public internet.' In that scenario, enabling a service endpoint on the subnet provides secure and optimized connectivity to Storage.
Why candidates choose this
Candidates may confuse service endpoints with routing or think that service endpoints can be used to force traffic through an NVA, not understanding that service endpoints only affect traffic to specific Azure services and do not redirect general internet traffic.
✗A NAT gateway on the NVA subnet onlyWrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides source network address translation for outbound traffic but does not force traffic through an NVA for inspection; it only changes the source IP and allows direct internet access.
★ When this WOULD be the correct answer
If the requirement is to provide outbound internet connectivity to a subnet with a single, predictable public IP address (e.g., for whitelisting), and no inspection is needed, you would configure a NAT gateway on the subnet or its route table.
Why candidates choose this
Candidates may confuse NAT gateway with a means to route traffic through an NVA, not realizing that NAT gateway is for source translation and does not redirect traffic to a next hop.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
UDR
UDR is a user-defined routing rule that controls how network traffic moves between subnets or to external destinations in a cloud or on-premises environment.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.