Question 9 of 194
Why Traffic Bypasses NVA: Enable IP Forwarding on Network Interface
A company has two Azure virtual networks, VNet-A (hub) and VNet-B (spoke), connected via VNet peering. They deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. They configure a user-defined route (UDR) on the subnet in VNet-B with the destination address space of VNet-A (10.0.0.0/16) and the next hop set to the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes a direct path. What is the most likely cause?
Quick Answer
The answer is that the NVA network interface does not have IP forwarding enabled. This is the most likely cause because a network virtual appliance must explicitly be configured to forward packets not destined for its own IP address; without IP forwarding enabled on the NIC, the NVA drops any traffic whose destination is another host, causing the user-defined route to be ignored and traffic to bypass the NVA via the direct VNet peering path. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of how NVAs function as routers within a hub-and-spoke topology, and it’s a common trap to assume that simply setting a UDR is sufficient—you must also enable IP forwarding on the NVA’s network interface to troubleshoot NVA traffic not forwarding. Remember the memory tip: “If the NVA won’t forward, check the NIC’s IP forwarding switch.”
⚠ Common exam trap
Many exam-takers assume a UDR alone is sufficient to force traffic through an NVA, overlooking the mandatory IP forwarding setting on the NVA's NIC, which is a common misconfiguration in Azure networking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The NVA network interface does not have IP forwarding enabled
A network virtual appliance (NVA) requires IP forwarding to be enabled on its network interface to forward traffic not destined for itself. Without this setting, the NVA drops packets that arrive with a destination IP other than its own, causing the traffic to bypass the NVA and follow the default VNet peering route. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNets as specified by the user-defined route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NVA's private IP address is not reachable from VNet-B
Why it's wrong here
If the NVA were unreachable, traffic would fail, but the question states traffic still flows directly, not that it fails.
- ✗
VNet peering system routes override user-defined routes
Why it's wrong here
UDRs take precedence over system routes for the specified destination prefix. Peering system routes are overridden by UDRs.
- ✗
The UDR must be applied to the gateway subnet of VNet-B
Why it's wrong here
The UDR should be applied to the subnet where the source VMs are located, not the gateway subnet. The configuration described is correct in terms of subnet selection.
- ✓
The NVA network interface does not have IP forwarding enabled
Why this is correct
IP forwarding must be enabled on the NVA's NIC for it to forward traffic destined to other IPs. Without it, the NVA will drop the traffic, and the peering path remains active.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has two Azure virtual networks, VNet-A (hub) and VNet-B (spoke), connected via VNet peering. They deployed a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic. They configured a user-defined route (UDR) on the subnet in VNet-B that points the VNet-A address space (10.0.0.0/16) to the private IP of the NVA. However, traffic initiated from VNet-B to VNet-A still takes a direct path and bypasses the NVA. What is the most likely cause?
hard- ✓ A.The NVA does not have IP forwarding enabled on its network interface
- B.The UDR on VNet-B must also include a route for the default route (0.0.0.0/0) to force all traffic through the NVA
- C.VNet peering does not support user-defined routes
- D.The NVA must be deployed in the same subnet as the source VMs in VNet-B
Why A: In Azure, a network interface must have IP forwarding enabled for the NIC to receive packets that are not destined to its own IP address. When IP forwarding is disabled on the NVA's NIC, Azure does not deliver the traffic to the NVA; instead, the UDR is ineffective and the packet is routed via the system route for VNet peering, causing the traffic to bypass the NVA and take the direct path.
Variation 2. A company has two Azure virtual networks, VNet-A and VNet-B, connected via VNet peering. They want all traffic between the VNets to be inspected by a network virtual appliance (NVA) deployed in a subnet in VNet-A. They have configured a user-defined route (UDR) on the subnet in VNet-B that points the destination address space of VNet-A to the private IP of the NVA. However, traffic between the VNets is still not passing through the NVA. What is the most likely cause?
hard- A.The UDR is not associated with the subnet in VNet-B.
- ✓ B.The NVA's network interface (NIC) does not have IP forwarding enabled.
- C.The VNet peering connection is not in a 'Connected' state.
- D.The NVA is deployed in the same subnet as the source VMs.
Why B: The most likely cause is that the NVA's network interface (NIC) does not have IP forwarding enabled. Even with a correctly configured UDR on VNet-B pointing traffic to the NVA's private IP, the NVA will drop any traffic not destined for its own IP unless IP forwarding is enabled on its NIC. This setting allows the NVA to accept packets with a destination other than itself and forward them based on its routing table, which is essential for traffic inspection scenarios.
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.