AZ-500 Secure networking Practice Question
A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?
⚠ Common exam trap
Many exam-takers assume creating a route table with the correct route is sufficient, forgetting that the route table must be explicitly associated with the subnet to take effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table is not associated with the spoke subnet.
The most likely reason is that the route table containing the default route (0.0.0.0/0) pointing to the Azure Firewall private IP has not been associated with the spoke subnet. Without this association, the subnet continues to use system routes, which include a default route to the internet via the Azure default gateway, allowing traffic to bypass the firewall. Associating the route table with the subnet is a required step to override the system default route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The route table is not associated with the spoke subnet.
Why this is correct
A route table only takes effect when it is explicitly associated with a subnet. In this hub-spoke topology, the spoke subnet still has the default system routes, so traffic destined for the internet follows the default route and bypasses Azure Firewall. You must associate the custom route table—with a UDR that uses the firewall's private IP as the next hop and next hop type 'VirtualAppliance'—to the spoke subnet for forced tunneling to work.
- ✗
Azure Firewall is not configured with DNAT rules for outbound traffic.
Why it's wrong here
DNAT rules are used to translate inbound destination IP addresses and ports, mapping the firewall's public IP to an internal resource. Outbound traffic from a spoke does not require DNAT; Azure Firewall automatically performs source NAT (SNAT) on traffic leaving through its public IP. The failure here is due to the missing route table association, not because of absent DNAT rules.
- ✗
The spoke VNet peering does not allow gateway transit.
Why it's wrong here
Gateway transit is a peering option that lets a spoke VNet use the hub's VPN gateway to reach on-premises networks, not a requirement for Azure Firewall routing. Traffic to the firewall is driven by user-defined routes and the firewall's private IP as the next hop, not by the gateway transit setting. As long as VNet peering exists for basic connectivity, the firewall can be used as a next hop; disabling gateway transit does not prevent that.
- ✗
The route table has a higher priority than system routes.
Why it's wrong here
Incorrect. User-defined routes (in route tables) have a higher priority than system routes, so if the route table is associated, they would override the system default route. This statement is true but not a reason for failure.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.