AZ-500 Secure networking Practice Question
A company deploys Azure Firewall in a hub VNet to inspect all outbound traffic from a spoke VNet. They enable VNet peering between the hub and spoke. They create a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop, and associate it with the spoke subnets. However, outbound traffic from the spoke subnets is still going directly to the internet, bypassing the firewall. What is the most likely cause?
⚠ Common exam trap
Many candidates assume any custom route with a firewall IP will work, but Azure requires the next hop type to be explicitly set to 'Virtual appliance' to override the default system route for 0.0.0.0/0.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table's next hop type is not set to 'Virtual appliance'
The most likely cause is that the route table's next hop type is not set to 'Virtual appliance'. When creating a custom route in Azure, the next hop type must be explicitly set to 'Virtual appliance' and the next hop address must be the firewall's private IP. If the next hop type is left as 'Internet' or another value, Azure will ignore the custom route and use the default system route for 0.0.0.0/0, which sends traffic directly to the internet without inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table's next hop type is not set to 'Virtual appliance'
Why this is correct
For an Azure Firewall to inspect traffic via a user-defined route, the route's next hop type must be set to 'Virtual appliance' and the next hop address must be the firewall's private IP. If the next hop type is instead set to 'Internet', Azure treats the destination as directly reachable through the default route, so traffic egresses without ever hitting the firewall, even if the IP address field still contains the firewall's IP. This configuration error produces exactly the symptom described: traffic continues to flow, but none of it is actually inspected by the firewall.
- ✗
The route table is not associated with the subnet
Why it's wrong here
A route table that is not associated with the subnet would mean the custom next hop is never applied, and the subnet's traffic would simply use Azure's system default routes instead. However, the scenario explicitly states that the route table is created and associated, so this cannot be the cause. Even if the association were missing, the firewall would be completely uninvolved in the path, which is a different failure mode than the selective bypass caused by an incorrectly configured next hop type.
- ✗
The hub-spoke peering is not configured correctly
Why it's wrong here
Hub-spoke peering provides Layer 3 connectivity between the vnets, but peering configuration does not change how the spoke subnet's route table forwards packets. If peering were misconfigured, traffic would fail to reach the destination or fail to return; it would not silently bypass the Azure Firewall while still flowing end-to-end. In other words, a peering issue manifests as connectivity loss, not as uninspected traffic, so it cannot explain why traffic is bypassing the firewall.
- ✗
Azure Firewall is in a different resource group
Why it's wrong here
Azure Firewall can be deployed in any resource group because resource groups are logical administrative containers that do not affect network routing or IP reachability. A user-defined route references the firewall by its private IP address, which remains valid regardless of which resource group contains the firewall instance. Therefore, placing the firewall in a different resource group has no influence on whether the route table's next hop type is honored or whether traffic is inspected.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.