An administrator is designing a virtual network architecture in Microsoft Azure to support… — Microsoft Azure Administrator (AZ-104)

An administrator is designing a virtual network architecture in Microsoft Azure to support a hybrid application. The architecture consists of the following components:

* A hub virtual network named `VNet-Hub` with an address space of $10.1.0.0/22$ .
* A spoke virtual network named `VNet-Spoke` with an address space of $10.2.0.0/22$ .
* A web workload in `VNet-Spoke` that requires $28$ virtual machines, each needing a dynamic private IP address.
* An Azure Bastion host deployed in `VNet-Hub` to secure management access.
* An Azure VPN Gateway deployed in `VNet-Hub` to connect to the on-premises network.

The administrator wants to ensure that:

1. Virtual machines in `VNet-Spoke` can communicate with the on-premises network via the VPN Gateway in `VNet-Hub`.
2. Name resolution works for a private DNS zone named `corp.internal` across both virtual networks.
3. The Azure Bastion host is deployed in `VNet-Hub` using the minimum supported subnet size to conserve IP addresses.
4. The web workload subnet in `VNet-Spoke` is configured with the smallest possible subnet prefix that can support the $28$ virtual machines.

Which configuration meets the requirements?

Deploy Azure Bastion in a subnet named AzureBastionSubnet with a $10.1.3.0/26$ prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Enable gateway transit on the peering from VNet-Hub to VNet-Spoke and configure VNet-Spoke to use the remote gateway. Create a virtual network link in the corp.internal Private DNS zone for both virtual networks.Answer
B
Deploy Azure Bastion in a subnet named AzureBastionSubnet with a $10.1.3.0/27$ prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Enable gateway transit on the peering from VNet-Hub to VNet-Spoke and configure VNet-Spoke to use the remote gateway. Create a virtual network link in the corp.internal Private DNS zone for both virtual networks.
C
Deploy Azure Bastion in a subnet named AzureBastionSubnet with a $10.1.3.0/26$ prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Configure standard virtual network peering between VNet-Hub and VNet-Spoke without enabling gateway transit, as peered networks automatically route traffic to the VPN Gateway. Create a virtual network link in the corp.internal Private DNS zone for both virtual networks.
D
Deploy Azure Bastion in a subnet named AzureBastionSubnet with a $10.1.3.0/26$ prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Enable gateway transit on the peering from VNet-Hub to VNet-Spoke and configure VNet-Spoke to use the remote gateway. Register the corp.internal Private DNS zone in the subscription without creating virtual network links, as DNS resolution is automatically shared across peered virtual networks.

Answer

Deploy Azure Bastion in a subnet named AzureBastionSubnet with a

10.1.3.0/26

prefix in VNet-Hub. Configure the web workload subnet in VNet-Spoke using a /26 prefix. Enable gateway transit on the peering from VNet-Hub to VNet-Spoke and configure VNet-Spoke to use the remote gateway. Create a virtual network link in the corp.internal Private DNS zone for both virtual networks.

The correct configuration addresses all sizing, routing, name resolution, and specialized subnet constraints. Sizing the web workload subnet with a /26 prefix is necessary because a /27 subnet only offers 27 usable IP addresses (

32 - 5 = 27

usable due to Azure's five reserved IPs), which cannot support the 28 virtual machines. Furthermore, the configuration correctly defines a /26 prefix for the subnet named 'AzureBastionSubnet', establishes gateway transit for transit routing to the on-premises gateway, and links the Private DNS zone to both virtual networks.

Step-by-Step Solution

Calculate the required subnet size for the web workload.

A /26 prefix is required.

The web workload needs to support

28

virtual machines. Azure reserves

5

IP addresses in every subnet (first four and the last one). Therefore,

28 + 5 = 33

total IP addresses are required. A /27 subnet provides

32

addresses (

32 - 5 = 27

usable), which is one too few. The next size up is a /26 subnet which provides

64

addresses (

59

usable).

Identify the minimum requirements for the Azure Bastion subnet.

The subnet must be named 'AzureBastionSubnet' and use a prefix size of at least /26.

Azure enforces specific naming and size requirements for the Bastion subnet; configuring a smaller prefix (such as /27) results in deployment failures.

Configure hybrid connectivity for the spoke virtual network.

Enable 'Use the remote virtual network's gateway' on VNet-Spoke and 'Use this virtual network's gateway' (gateway transit) on VNet-Hub.

VNet peering is not transitive by default. To route spoke traffic to the on-premises network through the hub gateway, transit settings must be enabled.

Configure Private DNS resolution.

Create virtual network links from the Private DNS zone 'corp.internal' to both VNet-Hub and VNet-Spoke.

Private DNS zone resolution does not automatically propagate over peered networks; virtual network links must be configured for each VNet.

Key Concept

Azure Virtual Network planning, containing specific requirements for subnet sizing (incorporating Azure's five reserved IP addresses), specialized subnets (Azure Bastion and VPN Gateway), peering transit, and Private DNS linking.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics