How to Route All Outbound Internet Traffic from Spoke VMs Through Azure Firewall
A company has a hub-spoke network topology in Azure. The spoke virtual networks contain Azure virtual machines that need to access the internet. The security team requires that all outbound internet traffic from the spoke VMs passes through the Azure Firewall deployed in the hub virtual network for inspection and logging. Which configuration should be implemented to ensure this traffic is routed through the firewall?
Quick Answer
The correct answer is to create a user-defined route (UDR) in the spoke subnet with a 0.0.0.0/0 prefix pointing to the private IP of the Azure Firewall. This configuration forces all outbound internet traffic from spoke VMs to be routed through the firewall in the hub virtual network, ensuring every packet is inspected and logged as required. The technical concept here is that Azure’s default system route for 0.0.0.0/0 sends internet-bound traffic directly out, bypassing any security appliance; a UDR overrides this by setting the next hop to the firewall’s private IP, effectively funneling traffic through the hub. On the AZ-500 exam, this scenario tests your understanding of forced tunneling and network segmentation in a hub-spoke topology—a common trap is choosing Azure Firewall Manager or a VPN gateway, which handle policy distribution or site-to-site traffic, not default route enforcement. Remember the memory tip: “Zero-zero-zero-zero goes to the firewall’s door” to recall that the 0.0.0.0/0 UDR is the key to routing all spoke internet traffic through Azure Firewall.
⚠ Common exam trap
Many exam-takers confuse Azure Firewall Manager's ability to propagate routes in a virtual WAN with the need for explicit UDRs in a traditional hub-spoke topology using a hub virtual network, leading them to incorrectly select option C as a one-click solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user-defined route (UDR) in the spoke subnet with 0.0.0.0/0 pointing to the private IP of the Azure Firewall.
A user-defined route (UDR) with the 0.0.0.0/0 prefix and the next hop set to the private IP address of the Azure Firewall forces all outbound internet traffic from the spoke subnet to be routed through the firewall in the hub. This ensures the traffic passes through the firewall for inspection and logging, as required by the security team.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an Azure Load Balancer in the hub to distribute traffic from spokes to the firewall.
Why it's wrong here
A load balancer distributes incoming traffic, but does not route outbound traffic from spoke VMs through the firewall. It would not force traffic to the firewall as a next hop.
- ✓
Create a user-defined route (UDR) in the spoke subnet with 0.0.0.0/0 pointing to the private IP of the Azure Firewall.
Why this is correct
The UDR with default route pointing to the firewall's private IP ensures that all outbound internet traffic from the spoke VMs is forwarded to the firewall for inspection and logging.
- ✗
Use Azure Firewall Manager to automatically enforce a global default route on all spokes. This is the only configuration needed.
Why it's wrong here
Azure Firewall Manager can be used to apply routes, but it must be configured to create UDRs on the spoke subnets. The statement is misleading because the route is still a UDR created by the manager; the key action is the route itself.
- ✗
Enable IP forwarding on the NICs of the spoke VMs so they forward traffic to the firewall.
Why it's wrong here
IP forwarding is used when a VM acts as a network appliance, not to force outbound traffic. The routing must be done at the subnet level via UDRs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. You need to ensure that all outbound traffic from spoke VMs to the internet is routed through the Azure Firewall. What should you configure on the spoke virtual networks?
medium- A.Apply a network security group (NSG) to the spoke subnets with a deny rule for internet traffic
- B.Configure VNet peering with 'Use remote gateway' enabled
- ✓ C.Create a route table with a route for 0.0.0.0/0 pointing to the Azure Firewall private IP, and associate it with the spoke subnets
- D.Configure the Azure Firewall to use forced tunneling
Why C: Creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP and associating it with the spoke subnets forces all outbound internet traffic from spoke VMs to be forwarded to the firewall for inspection. This is the standard method for implementing forced tunneling in a hub-and-spoke topology, ensuring traffic flows through the central security appliance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.