AZ-500 Secure networking Practice Question
A company is designing a hub-spoke network topology with Azure Firewall in the hub virtual network. Spoke virtual networks are peered to the hub. They want to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. However, traffic is still bypassing the firewall. What is the most likely cause?
⚠ Common exam trap
Many candidates assume creating a route table and adding a default route is sufficient, overlooking the critical step of associating the route table to the subnet, which is a distinct configuration action in the Azure portal or CLI.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The route table is not associated to the spoke subnet.
The most likely cause is that the route table with the default route (0.0.0.0/0) pointing to the Azure Firewall's private IP has not been associated to the spoke subnet. Without this association, the route table is not applied to the subnet's traffic, so the default system route (which directs internet traffic directly to the internet) remains in effect, bypassing the firewall. Associating the route table to the subnet is a required step for user-defined routes (UDRs) to influence traffic flow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure Firewall is in a different region than the spoke VNet.
Why it's wrong here
Azure Firewall is a managed service that is routable via a private IP; VNet peering, including global peering, enables connectivity between hub and spoke VNets in different regions. As long as the spoke subnet has a route table with a next-hop of the firewall's private IP, traffic will be forwarded to the firewall regardless of region. The absence of a regional match does not change routing behavior, so this cannot be the reason traffic bypasses the firewall.
- ✓
The route table is not associated to the spoke subnet.
Why this is correct
A user-defined route table only takes effect when it is explicitly associated with a subnet; simply creating a route table and adding a route to the firewall's private IP does nothing otherwise. Without that association, the subnet uses Azure's default system routes, which send traffic between peered VNets directly, bypassing the firewall entirely. This is the classic cause of 'spoke traffic isn't going through the firewall' when the routes appear to be configured correctly.
- ✗
The Azure Firewall does not have the correct network and application rules configured.
Why it's wrong here
Even if rules are missing, traffic would attempt to route through the firewall but be dropped, not bypass it. The question is about traffic bypassing the firewall entirely, which indicates a routing issue, not a rule issue.
- ✗
The spoke VNet has the 'Use remote virtual network gateways' setting disabled.
Why it's wrong here
The 'Use remote virtual network gateways' peering setting is specifically for gateway transit scenarios, where a VPN or ExpressRoute gateway in the hub is shared with peers, not for Azure Firewall, which is not a virtual network gateway. Azure Firewall is exposed via a standard private IP, and traffic is redirected to it using UDRs with next-hop type 'Virtual appliance'. Disabling this setting has no effect on firewall routing, so it cannot be the reason traffic is bypassing the firewall.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.