A lock-app subnet has a default system route to Internet, but the security engineer needs PaaS-bound traffic to take the firewall path instead. What routing behavior should they rely on?
Select an answer to reveal the explanation.
Short Explanation
Azure’s default “go Internet” path loses to your UDR. Plant 0.0.0.0/0—or a tighter prefix—and the more specific route wins the race to the firewall.
Full Explanation
User-defined routes override system routes for matching prefixes, which is why a UDR default route can force traffic through a firewall instead of the system Internet next hop. Longest-prefix match still applies: a more specific user-defined prefix wins over a less specific one. Private Endpoints and service endpoints are separate private-access features and do not explain UDR-versus-system-route precedence for this inspection requirement.