AZ-500 Secure networking Practice Question
A company has an Azure virtual network with two subnets: Frontend and Backend. They deploy a network virtual appliance (NVA) in a subnet named NVA_Subnet. They want to route all traffic from the Frontend subnet to the Backend subnet through the NVA for inspection. What is the minimum number of route tables required to achieve this traffic steering?
⚠ Common exam trap
It's easy for candidates to assume each subnet requires its own route table, or that the NVA subnet itself needs a custom route, but Azure's default routing handles the return path unless asymmetric routing is explicitly required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
1
A single route table can be associated with the Frontend subnet and configured with a user-defined route (UDR) that has the NVA's private IP as the next hop for traffic destined to the Backend subnet. This ensures all traffic from Frontend to Backend is forwarded to the NVA for inspection. No additional route tables are needed because the NVA itself handles the routing decision after inspection, and the Backend subnet does not require a specific route to return traffic unless asymmetric routing is a concern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
1
Why this is correct
A single route table associated with the Frontend subnet is all that is required. You define one user-defined route (UDR) with the Backend subnet's address space as the destination and the NVA's private IP as the next hop. Because the traffic flow originates only from Frontend to Backend, outbound traffic on Frontend is steered through the NVA, while return traffic automatically uses the default system routes without requiring a separate route table on the Backend subnet.
- ✗
2
Why it's wrong here
Two route tables are only necessary if you require symmetric traffic — meaning traffic in both directions must traverse the NVA. The question explicitly asks only about traffic from Frontend to Backend, so adding a second route table on Backend would be an unnecessary configuration. It could also lead to asymmetric routing, where request and response paths differ, potentially breaking stateful filtering or NAT on the NVA.
- ✗
3
Why it's wrong here
Three route tables are not a valid configuration for this two-subnet network. Azure allows each subnet to be associated with exactly one route table, so the maximum number of associated route tables is two. Adding a third table would either duplicate existing rules with no benefit or leave a table unassociated, which has no effect on traffic flow.
- ✗
4
Why it's wrong here
Four route tables are excessive because the network contains only two subnets, and each subnet can have at most one route table associated. Even if you needed selective routing, you could only associate two tables; the remaining two would be unused, adding management overhead without changing traffic behavior. This option is clearly incorrect for steering traffic between the two subnets.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.