An administrator is configuring a new virtual network named `VNet1` in an Azure subscripti… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring a new virtual network named `VNet1` in an Azure subscription to support a hybrid application architecture.

The virtual network has the following requirements:
- A subnet named `Subnet-Web` must host $11$ virtual machine instances that require private IP addresses.
- An Azure Bastion host must be deployed to provide secure connectivity to the virtual machines.
- A virtual network gateway must be deployed to support both an ExpressRoute connection and a VPN gateway in a coexisting configuration.
- Internal name resolution for resources in the virtual network must be resolved using an Azure Private DNS zone named `corp.internal`.

The administrator allocates the address block $10.150.20.0/24$ for `VNet1`.

Which two configurations should the administrator implement to meet the requirements while minimizing address space consumption? (Select two.)

`AzureBastionSubnet` configured with the address block $10.150.20.64/26$ Answer
`GatewaySubnet` configured with the address block $10.150.20.0/27$ Answer
C
`AzureBastionSubnet` configured with the address block $10.150.20.64/28$
D
A Private DNS zone virtual network link for `corp.internal` associated directly with `Subnet-Web`

Answer

The correct configurations are allocating a slash twenty-six address block for the subnet named AzureBastionSubnet, and allocating a slash twenty-seven address block for the subnet named GatewaySubnet.

The correct answers are the configurations specifying the Azure Bastion subnet as a slash twenty-six block and the GatewaySubnet as a slash twenty-seven block. Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' with a subnet mask of slash twenty-six or larger. For the coexistence of an ExpressRoute gateway and a VPN gateway, Azure requires the subnet named 'GatewaySubnet' to have a prefix of slash twenty-seven or larger. Both of these configurations satisfy these requirements and fit within the parent address space without overlapping.

Step-by-Step Solution

Determine the sizing and naming requirements for the Azure Bastion subnet.

The subnet must be named exactly `AzureBastionSubnet` and have a prefix size of at least

/26

Azure Bastion requires a dedicated subnet with a prefix size of

/26

or larger to accommodate its scale-out instances.

Determine the sizing and naming requirements for the GatewaySubnet under coexistence.

The subnet must be named exactly `GatewaySubnet` and have a prefix size of at least

/27

To support coexistence of an ExpressRoute gateway and a VPN gateway, Azure requires a gateway subnet of at least

/27

or larger.

Evaluate the requirement for the Private DNS zone link.

The virtual network link must be associated with the virtual network `VNet1`.

Private DNS zones are linked at the virtual network level, not at the subnet level.

Perform subnetting design to ensure configurations fit within the

10.150.20.0/24

address space without overlap.

`GatewaySubnet` allocated

10.150.20.0/27

(IPs

10.150.20.0

10.150.20.31

), `AzureBastionSubnet` allocated

10.150.20.64/26

(IPs

10.150.20.64

10.150.20.127

), and `Subnet-Web` allocated

10.150.20.32/28

(IPs

10.150.20.32

10.150.20.47

). All fit cleanly with no overlaps.

To confirm that the chosen blocks are valid subnetting designs under the parent CIDR block.

Key Concept

Azure Virtual Network subnet sizing constraints, naming requirements, and service-specific restrictions (Azure Bastion, Gateway coexistence, and Private DNS linking).

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics