AZ-500 Secure networking Practice Question
A company has an Azure virtual network with subnets SubnetA and SubnetB. They deploy a network virtual appliance (NVA) in a subnet called NVA_Subnet. They want all traffic between SubnetA and SubnetB to be routed through the NVA for inspection. What is the minimum number of route tables and routes required?
⚠ Common exam trap
Test-takers frequently assume a single route table can be applied to multiple subnets or that a default route (0.0.0.0/0) will force inter-subnet traffic through the NVA, when in fact Azure requires explicit routes for each subnet's destination address space and separate route table associations per subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Two route tables, each with a route to the other subnet via the NVA
Azure route tables are associated with subnets, not the virtual network as a whole. To force traffic between SubnetA and SubnetB through the NVA, you need two separate route tables: one for SubnetA with a route to SubnetB's address space with the next hop set to the NVA's private IP, and one for SubnetB with a route to SubnetA's address space with the next hop set to the NVA's private IP. This ensures bidirectional traffic is inspected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
One route table with a route for each subnet via the NVA
Why it's wrong here
A route table can only be associated to one subnet at a time, so a single route table cannot cover both subnets unless they share the same route set, which is not the case here as each subnet needs a specific route to the other.
- ✓
Two route tables, each with a route to the other subnet via the NVA
Why this is correct
A route table associated with a subnet influences only traffic originating from that subnet. Because subnet A and subnet B have different destination prefixes for their inter-subnet traffic, the proper design is two custom route tables, one bound to each subnet, each containing a single route: for subnet A, destination subnet B's address prefix with next hop set to the NVA; for subnet B, destination subnet A's prefix with next hop to the NVA. This forces the NVA to inspect every packet crossing between the two subnets while leaving all other traffic to the system routes.
- ✗
No route tables needed; enable IP forwarding on the NVA
Why it's wrong here
Enabling IP forwarding on the NVA's network interface is a necessary prerequisite—it allows the NVA to accept and route packets whose destination IP is not its own—but it is not a substitute for user-defined routes. Without UDRs, Azure's system route for the VNet address space remains the longest-prefix match for inter-subnet traffic, so packets from subnetA to subnetB are delivered directly by the Azure fabric and never traverse the NVA. The NVA can only intercept the traffic if a UDR with next hop 'Virtual appliance' points the destination subnet prefix to it.
- ✗
One route table with a single default route (0.0.0.0/0) via the NVA
Why it's wrong here
A default route of 0.0.0.0/0 only matches traffic when no more specific route exists. For traffic between subnetA and subnetB, Azure's built-in system route for the VNet's own address space (for example, 10.0.0.0/16) is far more specific and therefore always wins, so packets continue to use direct routing within the virtual network. The default route would send only internet-bound traffic to the NVA, leaving inter-subnet traffic un-inspected, which makes this a fundamental mismatch for the requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.