AZ-500 Secure networking Practice Question
Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume a default route (0.0.0.0/0) UDR will always override all other routes, but Azure's route selection uses longest prefix match, so more specific BGP-learned routes for on-premises networks will take precedence over the default UDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR
The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR
Why this is correct
BGP-learned routes for on-premises networks are more specific than 0.0.0.0/0. They will be used even if a UDR for 0.0.0.0/0 exists. To force through firewall, you must either disable BGP route propagation or create specific UDRs for on-premises ranges.
- ✗
The UDR must be applied to the subnet that hosts the Azure Firewall
Why it's wrong here
User-defined routes in Azure are associated with source subnets, not with the subnet hosting the network virtual appliance. The AzureFirewallSubnet's route table governs only the firewall's own outbound traffic, not how workloads in the spoke select a next hop. In this scenario, the spoke's UDR already points 0.0.0.0/0 to the firewall's private IP, so that part is correctly configured. Modifying the firewall subnet's UDR would have no effect on spoke traffic because the firewall's route table is not consulted by intermediary devices when routing packets from the spoke.
- ✗
The spoke subnet does not have 'GatewaySubnet' route propagation enabled
Why it's wrong here
Route propagation refers to learning BGP routes from a VPN gateway. If it were disabled, the spoke would not learn on-premises routes and would use the 0.0.0.0/0 UDR for all traffic. In this case, the problem is that propagation is enabled and the more specific routes override.
- ✗
The Azure Firewall is not configured with a route to the on-premises network
Why it's wrong here
A missing route to the on-premises network on the Azure Firewall would cause the firewall to drop or discard packets it receives that are destined for those addresses; it would not cause the spoke to bypass the firewall. The reported symptom—traffic reaching on-premises without traversing the firewall—indicates the spoke's virtual machine is sending packets directly to the VPN gateway. This happens because the BGP-learned prefix for the on-premises network is more specific than the 0.0.0.0/0 UDR and thus wins on route preference. The firewall's own routing configuration is irrelevant here, since the firewall never even sees the bypassing traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.