AZ-700 Question 11
Single answerYour organization is deploying multiple Azure resources, including Azure Firewall, private endpoints for a database service, and several web applications. The design must meet the following requirements: � Azure Firewall must be placed in a dedicated subnet. � Private endpoints must be secured and not share a subnet with publicly accessible resources. � The web applications should be placed in a subnet that can have network security groups (NSGs) applied.
Which approach should you choose to meet these requirements and follow best practices?
- A
Use a single shared subnet for Azure Firewall, private endpoints, and web applications to simplify IP address management.
- B
Create a dedicated /26 subnet named AzureFirewallSubnet for Azure Firewall, a separate subnet for private endpoints, and another subnet for the web applications.
- C
Place the Azure Firewall and private endpoints in a single subnet and the web applications in a separate subnet to minimize subnet complexity.
- D
Create a dedicated subnet for private endpoints but allow Azure Firewall and web applications to share a different subnet.
Show answer and explanation
Correct answer: B
Explanation
Azure documentation and best practices recommend deploying certain services in dedicated subnets. Azure Firewall must reside in a subnet named AzureFirewallSubnet with a minimum of /26 to allow for scaling. Private endpoints require a separate subnet that doesn't host publicly accessible resources, helping you more effectively control access and prevent security conflicts. Web applications should be placed in their own subnet that allows application of network security groups and routing configurations as needed. For details, see Microsoft documentation on deploying Azure Firewall (https://learn.microsoft.com/azure/firewall/deploy-azure-firewall) and Private Endpoint subnet requirements (https://learn.microsoft.com/azure/private-link/private-endpoint-overview).
- A. Incorrect.
Incorrect: Although it simplifies IP management, Azure Firewall requires its own dedicated subnet named AzureFirewallSubnet with a minimum subnet size of /26. Private endpoints also shouldn't share subnets with publicly accessible resources.
- B. Correct.
Correct: Azure Firewall requires a dedicated subnet with at least a /26 address space. Private endpoints should be isolated in their own subnet to avoid conflicts with NSGs and routing policies that may affect data flows. The web applications should reside in another subnet where NSGs can be safely applied.
- C. Incorrect.
Incorrect: Combining the firewall and private endpoints in one subnet violates best practices. Private endpoints are recommended to be isolated because they require unique subnet configurations, and Azure Firewall needs a dedicated subnet named AzureFirewallSubnet with /26 or larger.
- D. Incorrect.
Incorrect: While having a dedicated subnet for private endpoints is correct, Azure Firewall also needs a dedicated subnet to function properly according to Azure requirements.