This AZ-500 practice question tests your understanding of secure networking. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: iP forwarding allows an NVA to route traffic not addressed to its own NIC.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company has two Azure virtual networks: VNet-A (10.0.0.0/16) and VNet-B (10.1.0.0/16). They are connected via VNet peering. You deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. You configure a user-defined route (UDR) on the subnet in VNet-B that points the address space of VNet-A (10.0.0.0/16) to the next hop as the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes the direct peered path. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP forwarding is not enabled on the NVA's network interface
The NVA must have IP forwarding enabled on its network interface to forward traffic that is not destined to its own IP address. Without IP forwarding, the NVA will drop packets routed to it via the UDR, causing traffic to fall back to the default peered path. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNet-A and VNet-B as intended.
Key principle: IP forwarding allows an NVA to route traffic not addressed to its own NIC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The UDR is not applied to the subnet in VNet-B
Why it's wrong here
The question states the UDR is configured on the subnet, so this is not the cause.
✓
IP forwarding is not enabled on the NVA's network interface
Why this is correct
IP forwarding must be enabled on the NIC of the NVA to allow it to forward traffic not addressed to itself. This is a common oversight.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
IP forwarding allows an NVA to route traffic not addressed to its own NIC.
✗
VNet peering does not support user-defined routes
Why it's wrong here
VNet peering works with UDRs; system routes can be overridden by UDRs on the subnet.
✗
The NVA must be in the same virtual network as the spoke
Why it's wrong here
The NVA can be in a different VNet (hub) as long as there is peering and UDRs pointing to it.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume configuring a UDR is sufficient to force traffic through an NVA, overlooking the mandatory IP forwarding setting on the NVA's network interface.
Detailed technical explanation
How to think about this question
In Azure, a network interface (NIC) by default drops any packet not addressed to its own IP. IP forwarding, when enabled, allows the NIC to accept and forward packets destined to other IPs, effectively turning the VM into a router. This is a required step for any NVA scenario, and it must be enabled both in the Azure portal (on the NIC) and within the VM's OS (e.g., via `sysctl net.ipv4.ip_forward=1` on Linux or registry key on Windows).
KKey Concepts to Remember
IP forwarding allows an NVA to route traffic not addressed to its own NIC.
UDRs can override Azure's default system routes, including VNet peering routes.
NVAs require IP forwarding enabled on their NICs to act as an intermediary for traffic.
VNet peering allows traffic between VNets, but UDRs can redirect it through an NVA.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
IP forwarding allows an NVA to route traffic not addressed to its own NIC.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review iP forwarding allows an NVA to route traffic not addressed to its own NIC., then practise related AZ-500 questions on the same topic to reinforce the concept.
Secure networking — This question tests Secure networking — IP forwarding allows an NVA to route traffic not addressed to its own NIC..
What is the correct answer to this question?
The correct answer is: IP forwarding is not enabled on the NVA's network interface — The NVA must have IP forwarding enabled on its network interface to forward traffic that is not destined to its own IP address. Without IP forwarding, the NVA will drop packets routed to it via the UDR, causing traffic to fall back to the default peered path. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNet-A and VNet-B as intended.
What should I do if I get this AZ-500 question wrong?
Review iP forwarding allows an NVA to route traffic not addressed to its own NIC., then practise related AZ-500 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
IP forwarding allows an NVA to route traffic not addressed to its own NIC.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.