AZ-700 Question 12
Select 2You are designing a single Azure virtual network (VNet1) to host Azure Bastion, Azure Firewall, and a set of virtual machines (VMs). You want to ensure each service is placed in an appropriate subnet. Which two of the following statements are correct? (Choose two.)
- A
You must create a dedicated subnet named AzureBastionSubnet for Azure Bastion, and it cannot host any other workloads.
- B
Azure Firewall can coexist in a shared subnet with VMs as long as Network Security Groups (NSGs) are configured properly.
- C
It is acceptable to deploy VMs into AzureBastionSubnet provided Bastion is disabled during VM provisioning.
- D
You must create a dedicated subnet named AzureFirewallSubnet for Azure Firewall, and it cannot host other services.
Show answer and explanation
Correct answers: A, D
Explanation
Azure Bastion and Azure Firewall each require dedicated subnets with specific names (AzureBastionSubnet and AzureFirewallSubnet, respectively). These subnets must be used exclusively for their respective services and cannot host additional resources. Refer to Microsoft documentation for Azure Bastion (https://learn.microsoft.com/azure/bastion/bastion-overview) and Azure Firewall (https://learn.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal) for detailed subnet configuration guidelines.
- A. Correct.
Option 1 is correct. Azure Bastion requires a dedicated subnet named AzureBastionSubnet, and that subnet cannot host any other service or workload.
- B. Incorrect.
Option 2 is incorrect. Azure Firewall requires its own dedicated subnet, named AzureFirewallSubnet. It cannot coexist with VMs or other services in the same subnet.
- C. Incorrect.
Option 3 is incorrect. Even if Bastion is temporarily disabled, its subnet must remain exclusively for Bastion and cannot host virtual machines or other resources.
- D. Correct.
Option 4 is correct. Azure Firewall must be deployed in a subnet named AzureFirewallSubnet, which cannot be shared with any other services or workloads.