- A
One route table with a route for each subnet via the NVA
Why wrong: A route table can only be associated to one subnet at a time, so a single route table cannot cover both subnets unless they share the same route set, which is not the case here as each subnet needs a specific route to the other.
- B
Two route tables, each with a route to the other subnet via the NVA
Each subnet requires its own route table with a custom route that directs traffic destined for the other subnet to the NVA. This ensures all inter-subnet traffic is inspected.
- C
No route tables needed; enable IP forwarding on the NVA
Why wrong: IP forwarding must be enabled on the NVA, but without custom routes, traffic will follow Azure's default routing (direct subnet-to-subnet) and bypass the NVA.
- D
One route table with a single default route (0.0.0.0/0) via the NVA
Why wrong: A default route only redirects traffic destined for the internet; inter-subnet traffic uses the local VNet route and would not be affected.
Quick Answer
The answer is two route tables, each with a single route to the other subnet via the NVA. This is correct because Azure route tables are applied at the subnet level, not the virtual network level, so you must create a dedicated route table for SubnetA that directs traffic destined for SubnetB’s address space to the NVA’s private IP, and a separate route table for SubnetB that directs traffic back to SubnetA through the same NVA. On the AZ-500 exam, this scenario tests your understanding of forced tunneling and custom routing for network security, often appearing as a trap where candidates mistakenly think one route table with two routes suffices. Remember, each subnet needs its own outbound direction: a common memory tip is “two tables, two directions—one hop per subnet.”
AZ-500 Secure networking Practice Question
This AZ-500 practice question tests your understanding of secure networking. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has an Azure virtual network with subnets SubnetA and SubnetB. They deploy a network virtual appliance (NVA) in a subnet called NVA_Subnet. They want all traffic between SubnetA and SubnetB to be routed through the NVA for inspection. What is the minimum number of route tables and routes required?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"minimum / minimize"Why it matters: Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Two route tables, each with a route to the other subnet via the NVA
Option B is correct because Azure route tables are associated with subnets, not the virtual network as a whole. To force traffic between SubnetA and SubnetB through the NVA, you need two separate route tables: one for SubnetA with a route to SubnetB's address space with the next hop set to the NVA's private IP, and one for SubnetB with a route to SubnetA's address space with the next hop set to the NVA's private IP. This ensures bidirectional traffic is inspected.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
One route table with a route for each subnet via the NVA
Why it's wrong here
A route table can only be associated to one subnet at a time, so a single route table cannot cover both subnets unless they share the same route set, which is not the case here as each subnet needs a specific route to the other.
- ✓
Two route tables, each with a route to the other subnet via the NVA
Why this is correct
Each subnet requires its own route table with a custom route that directs traffic destined for the other subnet to the NVA. This ensures all inter-subnet traffic is inspected.
Clue confirmation
The clue word "minimum / minimize" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
No route tables needed; enable IP forwarding on the NVA
Why it's wrong here
IP forwarding must be enabled on the NVA, but without custom routes, traffic will follow Azure's default routing (direct subnet-to-subnet) and bypass the NVA.
- ✗
One route table with a single default route (0.0.0.0/0) via the NVA
Why it's wrong here
A default route only redirects traffic destined for the internet; inter-subnet traffic uses the local VNet route and would not be affected.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume a single route table can be applied to multiple subnets or that a default route (0.0.0.0/0) will force inter-subnet traffic through the NVA, when in fact Azure requires explicit routes for each subnet's destination address space and separate route table associations per subnet.
Detailed technical explanation
How to think about this question
Azure's default system routes automatically allow direct communication between subnets within the same virtual network. To override this, you must create user-defined routes (UDRs) with a next hop type of 'Virtual appliance' and specify the NVA's private IP. The NVA must also have IP forwarding enabled at the network interface level (via Azure CLI or portal) and within the guest OS (e.g., for Linux, net.ipv4.ip_forward=1). This setup is commonly used for east-west traffic inspection in hub-and-spoke topologies.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Secure networking — study guide chapter
Learn the concepts, then practise the questions
- →
Secure networking practice questions
Targeted practice on this topic area only
- →
All AZ-500 questions
1,000 questions across all exam domains
- →
Microsoft Azure Security Engineer Associate AZ-500 study guide
Full concept coverage aligned to exam objectives
- →
AZ-500 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-500 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Secure identity and access practice questions
Practise AZ-500 questions linked to Secure identity and access.
Secure compute, storage, and databases practice questions
Practise AZ-500 questions linked to Secure compute, storage, and databases.
Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel practice questions
Practise AZ-500 questions linked to Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel.
Manage identity and access practice questions
Practise AZ-500 questions linked to Manage identity and access.
Secure networking practice questions
Practise AZ-500 questions linked to Secure networking.
AZ-500 fundamentals practice questions
Practise AZ-500 questions linked to AZ-500 fundamentals.
AZ-500 scenario practice questions
Practise AZ-500 questions linked to AZ-500 scenario.
AZ-500 troubleshooting practice questions
Practise AZ-500 questions linked to AZ-500 troubleshooting.
Practice this exam
Start a free AZ-500 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-500 question test?
Secure networking — This question tests Secure networking — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Two route tables, each with a route to the other subnet via the NVA — Option B is correct because Azure route tables are associated with subnets, not the virtual network as a whole. To force traffic between SubnetA and SubnetB through the NVA, you need two separate route tables: one for SubnetA with a route to SubnetB's address space with the next hop set to the NVA's private IP, and one for SubnetB with a route to SubnetA's address space with the next hop set to the NVA's private IP. This ensures bidirectional traffic is inspected.
What should I do if I get this AZ-500 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "minimum / minimize". Asks for the least resource use — fewest addresses, smallest subnet, lowest overhead. Eliminate over-provisioned options even if they would technically work.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.