AZ-700 Question 6
Single answerYou need to deploy a new three-tier application in Azure. The design requires a single virtual network (VNet) named AppVNet with the address space 10.0.0.0/16. You plan to create two subnets: a FrontEnd subnet (10.0.0.0/24) for web servers that must accept inbound HTTP traffic from the Internet and a BackEnd subnet (10.0.1.0/24) restricted to internal communication. Which of the following actions is essential to ensure the planned network configuration is valid and will allow both subnets to be created successfully?
- A
Use subnet address prefixes that do not overlap with each other and fall within the VNet address space
- B
Assign each subnet an address space that spans the entire 10.0.0.0/16 range
- C
Enable IP forwarding on the virtual network before adding any subnets
- D
Configure a service endpoint in the FrontEnd subnet to allow HTTP inbound traffic
Show answer and explanation
Correct answer: A
Explanation
When creating a virtual network in Azure, each subnet� address range must be a non-overlapping subset of the VNet� address space. The VNet (10.0.0.0/16) is subdivided into 10.0.0.0/24 and 10.0.1.0/24 for FrontEnd and BackEnd, ensuring no address conflicts. Refer to Microsoft Azure Virtual Network Subnet Planning guidelines at https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview for more details.
- A. Correct.
Correct. Subnet address ranges must be non-overlapping and must lie entirely within the VNet address space (10.0.0.0/16). Overlapping subsets or addresses outside the VNet range prevent successful subnet creation.
- B. Incorrect.
Incorrect. Each subnet should have a unique sub-range within the 10.0.0.0/16 space; assigning the entire address block to each subnet would overlap and fail creation.
- C. Incorrect.
Incorrect. IP forwarding is an optional feature usually enabled for network virtual appliances, not a requirement for creating valid subnets.
- D. Incorrect.
Incorrect. Service endpoints are for secure Azure service access, not for basic inbound HTTP. A Network Security Group (NSG) rule can open HTTP inbound, but it does not affect subnet creation validity.