Your company is designing a secure hub-and-spoke network topology in Azure. The hub virtua… — Microsoft Azure Administrator (AZ-104)

Your company is designing a secure hub-and-spoke network topology in Azure. The hub virtual network, named `vnet-prod-us`, is allocated the address space $10.100.0.0/22$ . The following subnets must be provisioned within `vnet-prod-us`:

- A subnet for Azure Bastion to secure administrative access.
- A subnet for a VPN Gateway to connect with an on-premises datacenter.
- A subnet named `snet-web-api` to host public web API endpoints that require at least 28 usable IP addresses.
- A subnet named `snet-microservices` to host application microservices that require at least 120 usable IP addresses.

Additionally, you deploy a Private DNS Zone named `private.contoso.com` for internal name resolution, and you peer `vnet-prod-us` with a spoke virtual network named `vnet-spoke-01` that has no gateway of its own. Spoke VMs must be able to resolve records in `private.contoso.com` and access the on-premises datacenter via the hub's VPN Gateway.

Which of the following configurations meets the subnet sizing requirements while ensuring valid name resolution and routing?

A
Configure `AzureBastionSubnet` as $10.100.0.0/26$ , `GatewaySubnet` as $10.100.0.64/27$ , `snet-web-api` as $10.100.0.128/26$ , and `snet-microservices` as $10.100.1.0/25$ . Create virtual network links in the `private.contoso.com` Private DNS Zone to both `vnet-prod-us` and `vnet-spoke-01`. Configure peering between the networks, but leave gateway transit disabled on both sides.
Configure `AzureBastionSubnet` as $10.100.0.0/26$ , `GatewaySubnet` as $10.100.0.64/27$ , `snet-web-api` as $10.100.0.128/26$ , and `snet-microservices` as $10.100.1.0/25$ . Create virtual network links in the `private.contoso.com` Private DNS Zone to both `vnet-prod-us` and `vnet-spoke-01$. Enable gateway transit on the peering link from `vnet-prod-us` and configure the peering link from `vnet-spoke-01` to use the remote gateway.Answer
C
Configure `AzureBastionSubnet` as $10.100.0.0/27$ , `GatewaySubnet` as $10.100.0.32/27$ , `snet-web-api` as $10.100.0.64/27$ , and `snet-microservices` as $10.100.1.0/25$ . Create virtual network links in the `private.contoso.com` Private DNS Zone to both `vnet-prod-us` and `vnet-spoke-01`. Enable gateway transit on the peering link from `vnet-prod-us` and configure the peering link from `vnet-spoke-01` to use the remote gateway.
D
Configure `AzureBastionSubnet` as $10.100.0.0/26$ , `GatewaySubnet` as $10.100.0.64/27$ , `snet-web-api` as $10.100.0.128/26$ , and `snet-microservices` as $10.100.1.0/25$ . Create a virtual network link in the `private.contoso.com` Private DNS Zone to `vnet-prod-us` only. Enable gateway transit on the peering link from `vnet-prod-us` and configure the peering link from `vnet-spoke-01` to use the remote gateway.

Answer

The configuration that sets `AzureBastionSubnet` to /26, `GatewaySubnet` to /27, `snet-web-api` to /26, `snet-microservices` to /25, links the Private DNS zone to both virtual networks, and configures peering with gateway transit enabled.

The correct configuration establishes valid subnet sizes aligned to subnet boundaries without overlap. The `AzureBastionSubnet` is configured as /26, meeting the minimum deployment requirement. The `GatewaySubnet` is configured as /27, meeting the recommended size. The `snet-web-api` is configured as /26, which provides 59 usable IP addresses (exceeding the requirement of 28, whereas a /27 only provides 27 usable IPs due to the 5 reserved addresses in Azure). The `snet-microservices` is configured as /25, providing 123 usable IP addresses (exceeding the requirement of 120). Finally, it links the Private DNS Zone to both virtual networks to support name resolution and configures peering transit to allow spoke VMs to reach the on-premises VPN Gateway.

Step-by-Step Solution

Calculate the prefix size needed for the Azure Bastion subnet.

The subnet must be named `AzureBastionSubnet` and have a prefix size of at least /26 (e.g.,

10.100.0.0/26

Microsoft Azure mandates that Azure Bastion must be deployed in a dedicated subnet named `AzureBastionSubnet` with a minimum prefix size of /26.

Calculate the subnet size needed for `snet-web-api` to host at least 28 usable IP addresses.

A /26 prefix size is required.

Azure reserves 5 IP addresses in every subnet (first 4 and last 1). A /27 subnet provides 32 addresses, leaving only 27 usable IPs (

32 - 5 = 27

), which fails the requirement. A /26 subnet provides 64 addresses, leaving 59 usable IPs (

64 - 5 = 59

), which satisfies the requirement.

Calculate the subnet size needed for `snet-microservices` to host at least 120 usable IP addresses.

A /25 prefix size is required.

A /25 subnet provides 128 addresses. After subtracting Azure's 5 reserved IP addresses, it yields 123 usable IPs (

128 - 5 = 123

), which is sufficient for 120 hosts.

Determine the necessary configuration for Private DNS name resolution.

The Private DNS Zone `private.contoso.com` must be explicitly linked to both `vnet-prod-us` and `vnet-spoke-01`.

Private DNS Zone resolution does not transitively extend over virtual network peerings. Every virtual network containing VMs that require resolution must have a virtual network link to the Private DNS Zone.

Determine the required peering parameters to allow spoke VMs to access the on-premises datacenter via the hub gateway.

Enable 'Allow gateway transit' on the peering link from the hub, and enable 'Use remote gateways' on the peering link from the spoke.

Virtual network peering is non-transitive by default. Transit routing through a hub gateway must be explicitly enabled on both sides of the peering relationship.

Key Concept

Subnet planning in Azure requires accounting for 5 reserved IP addresses, complying with strict prefix sizing constraints for system subnets (like Azure Bastion), and explicitly configuring transit routing and DNS links in multi-VNet environments.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics