An administrator is planning the subnet topology for a new virtual network named `VNet-Pro… — Microsoft Azure Administrator (AZ-104)

An administrator is planning the subnet topology for a new virtual network named `VNet-Prod` in an Azure subscription. `VNet-Prod` is assigned the address space $10.150.16.0/20$ .

The administrator must configure the following subnets within `VNet-Prod` to support a hybrid application deployment:
- A subnet for a virtual network gateway to enable hybrid connectivity with an on-premises network. This subnet must use the smallest valid address space allowed by Azure.
- A subnet for Azure Bastion to enable secure administrative access. This subnet must use the smallest valid address space allowed by Azure.
- A subnet named `Subnet-Compute` that must host up to $124$ virtual machines.
- A subnet named `Subnet-Database` that must host up to $27$ database instances.

The administrator wants to define these subnets sequentially starting from the beginning of the `VNet-Prod` address space ( $10.150.16.0/20$ ), minimizing unallocated address space, and ensuring that no subnets overlap.

Which of the following subnet configurations should the administrator select?

GatewaySubnet: $10.150.16.0/29$ ; AzureBastionSubnet: $10.150.16.64/26$ ; Subnet-Database: $10.150.16.128/27$ ; Subnet-Compute: $10.150.17.0/24$ Answer
B
GatewaySubnet: $10.150.16.0/29$ ; AzureBastionSubnet: $10.150.16.64/26$ ; Subnet-Compute: $10.150.16.128/25$ ; Subnet-Database: $10.150.17.0/27$
C
GatewaySubnet: $10.150.16.0/29$ ; AzureBastionSubnet: $10.150.16.8/27$ ; Subnet-Database: $10.150.16.64/27$ ; Subnet-Compute: $10.150.17.0/24$
D
GatewaySubnet: $10.150.16.0/30$ ; AzureBastionSubnet: $10.150.16.64/26$ ; Subnet-Database: $10.150.16.128/27$ ; Subnet-Compute: $10.150.17.0/24$

Answer

GatewaySubnet: 10.150.16.0/29; AzureBastionSubnet: 10.150.16.64/26; Subnet-Database: 10.150.16.128/27; Subnet-Compute: 10.150.17.0/24

The correct configuration uses the smallest valid subnet masks that meet Azure requirements and host counts, while respecting subnet alignment boundaries. Specifically, the gateway subnet uses a /29 prefix (the minimum size for a GatewaySubnet), the Azure Bastion subnet uses a /26 prefix (the minimum size for AzureBastionSubnet), the database subnet uses a /27 prefix (which provides exactly the 32 addresses required for 27 databases plus 5 Azure-reserved IPs), and the compute subnet uses a /24 prefix (since 124 VMs plus 5 reserved IPs equals 129 IPs, which exceeds the 128-address limit of a /25 prefix). All blocks are aligned on their respective mathematical boundaries (multiples of their sizes), resulting in a valid and non-overlapping configuration.

Step-by-Step Solution

Determine the minimum prefix sizes required for Azure infrastructure subnets.

GatewaySubnet requires a minimum prefix of /29. AzureBastionSubnet requires a minimum prefix of /26.

Azure enforces these minimum size requirements for gateway and bastion deployments to ensure sufficient IP space for internal routing and scaling.

Calculate the minimum prefix sizes for application and database subnets, accounting for Azure-reserved IP addresses.

Subnet-Compute requires a /24 prefix (124 VMs + 5 reserved = 129 IPs, which exceeds the 128-address limit of a /25). Subnet-Database requires a /27 prefix (27 databases + 5 reserved = 32 IPs, which fits exactly in a /27).

Azure reserves 5 IP addresses per subnet (the first 4 and the last 1). These must be added to the workload host count to determine the minimum valid subnet block size.

Align the subnets sequentially on their respective binary boundaries starting from 10.150.16.0.

GatewaySubnet occupies 10.150.16.0/29 (10.150.16.0 - 10.150.16.7). AzureBastionSubnet is a /26 block and must start on a multiple of 64, which is 10.150.16.64/26 (10.150.16.64 - 10.150.16.127). Subnet-Database is a /27 block and must start on a multiple of 32, which is 10.150.16.128/27 (10.150.16.128 - 10.150.16.159). Subnet-Compute is a /24 block and must start on a /24 boundary (where the fourth octet is 0), which is 10.150.17.0/24 (10.150.17.0 - 10.150.17.255).

Classless Inter-Domain Routing (CIDR) requires subnets to start on addresses that are multiples of their block sizes. This alignment prevents overlap and ensures routing validity.

Key Concept

Azure-specific subnet sizing requirements combined with standard CIDR boundary alignment rules.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics