AZ-500 Secure networking Practice Question
A company has two Azure virtual networks, VNet-A and VNet-B, connected via VNet peering. They want all traffic between the VNets to be inspected by a network virtual appliance (NVA) deployed in a subnet in VNet-A. They have configured a user-defined route (UDR) on the subnet in VNet-B that points the destination address space of VNet-A to the private IP of the NVA. However, traffic between the VNets is still not passing through the NVA. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on UDR configuration or peering state, overlooking the critical NIC-level IP forwarding setting that is required for any NVA to function as a transit hop in Azure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NVA's network interface (NIC) does not have IP forwarding enabled.
The most likely cause is that the NVA's network interface (NIC) does not have IP forwarding enabled. Even with a correctly configured UDR on VNet-B pointing traffic to the NVA's private IP, the NVA will drop any traffic not destined for its own IP unless IP forwarding is enabled on its NIC. This setting allows the NVA to accept packets with a destination other than itself and forward them based on its routing table, which is essential for traffic inspection scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The UDR is not associated with the subnet in VNet-B.
Why it's wrong here
This is not the cause because the effective route table for traffic originating in VNet-A is determined by the subnets in VNet-A, not by any UDR in VNet-B. Traffic from the source VMs in VNet-A to the NVA's private IP is governed by the UDR associated with the source subnet; a missing or misassociated UDR on a VNet-B subnet has no influence on that first hop. Since the scenario states they configured a UDR on the source subnet and connectivity exists (traffic flows, just not through the NVA), a VNet-B association failure cannot explain why packets bypass the NVA.
- ✓
The NVA's network interface (NIC) does not have IP forwarding enabled.
Why this is correct
IP forwarding must be explicitly enabled on the network interface (NIC) of the NVA before Azure will deliver packets whose destination IP is not assigned to that NIC. Without it, the Azure fabric drops packets that are addressed to other IPs, so even if the NVA's operating system is configured to route traffic, the packets never reach it. This is the most common omission when deploying NVAs with UDRs, and it precisely explains why traffic flows end-to-end via peering but not through the NVA — the NVA silently discards (or never receives) the forwarded packets.
- ✗
The VNet peering connection is not in a 'Connected' state.
Why it's wrong here
If the VNet peering connection were not in a 'Connected' state, there would be no traffic at all between VNet-A and VNet-B, including the direct path the traffic is currently taking. The fact that traffic is flowing end-to-end (from source VMs to destination) proves the peering is functional and listed as 'Connected'. Peering state affects connectivity between the virtual networks, not whether a next hop in a UDR is honored, so a disconnected peering cannot be the reason the NVA is being bypassed.
- ✗
The NVA is deployed in the same subnet as the source VMs.
Why it's wrong here
Deploying the NVA in the same subnet as the source VMs is not inherently a problem and does not obviate the need for IP forwarding. When a UDR's next hop is an NVA's private IP, Azure routes packets to that IP directly if the NVA is in the same subnet; the NVA then needs IP forwarding to send them onward. Therefore, same-subnet placement does not prevent packet delivery to the NVA, and it is not the cause of the routing failure — the missing IP-forwarding flag on the NVA's NIC is.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.