Microsoft Azure Security Engineer Associate AZ-500 Practice Question

To force only Internet-destined traffic through the NVA, create one UDR with address prefix 0.0.0.0/0 and next hop type Virtual appliance pointing to 10.0.0.4. The system route for 10.1.0.0/16 created by VNet peering has a longer prefix than 0.0.0.0/0, so it remains in effect and continues to send traffic directly between the peer networks. Adding an explicit 10.1.0.0/16 UDR is unnecessary; setting its next hop to None would black-hole that traffic, and setting its next hop to Virtual network would be ignored because system routes already handle the prefix. Using next hop Internet on 0.0.0.0/0 would bypass the NVA entirely.