AZ-700 Question 7
Single answerYou are designing a new virtual network in Azure to host an ExpressRoute gateway, an Azure Bastion host, private endpoints (for Azure SQL Database and storage accounts), and an Application Gateway. You also plan to add Azure Firewall in the near future. You want to adhere to subnet naming requirements, avoid IP conflicts, and provide the required isolation for these services. Which approach should you use when creating subnets to meet these requirements?
- A
Place all services in a single /16 subnet and manage access using one network security group.
- B
Allocate a larger /22 subnet for the GatewaySubnet, then host the remaining services in a single /24 subnet.
- C
Create distinct subnets for each service: one named GatewaySubnet for the ExpressRoute gateway, one named AzureBastionSubnet for Bastion, one for private endpoints, one for the Application Gateway, and plan a separate AzureFirewallSubnet for the firewall.
- D
Deploy private endpoints, Application Gateway, and Azure Bastion together in a /25 subnet while using a /27 for the GatewaySubnet.
Show answer and explanation
Correct answer: C
Explanation
Azure guidelines and best practices specify using a dedicated 'GatewaySubnet' for the ExpressRoute or VPN gateway, 'AzureBastionSubnet' for Azure Bastion, 'AzureFirewallSubnet' for Azure Firewall, and consistently sized subnets for private endpoints and Application Gateway. This design minimizes IP conflicts, enforces logical separation, and supports future scalability. Refer to the Microsoft documentation on implementing Azure networking best practices for subnet planning and naming requirements.
- A. Incorrect.
Incorrect. Placing all services in a single subnet makes it difficult to isolate traffic and does not follow the required subnet naming conventions for Azure Bastion (AzureBastionSubnet) and gateways (GatewaySubnet).
- B. Incorrect.
Incorrect. Although setting a larger subnet for your gateway might be acceptable in some contexts, merging all remaining services into a single subnet introduces future scalability issues and goes against the recommended approach of isolating each service in its own subnet. You also need specific naming for Azure Bastion and Azure Firewall subnets.
- C. Correct.
Correct. Azure best practices state that each service (ExpressRoute gateway, Bastion, Application Gateway, Azure Firewall, and private endpoints) should have a dedicated subnet with adequate IP addresses. The gateway subnet must be named 'GatewaySubnet,' and the Bastion subnet must be named 'AzureBastionSubnet.' Azure Firewall also requires its own dedicated subnet, 'AzureFirewallSubnet.'
- D. Incorrect.
Incorrect. Consolidating multiple services (private endpoints, Application Gateway, and Azure Bastion) into a single small subnet does not follow Microsoft� recommended design. Private endpoints also often require multiple IP addresses, so a /25 might become too small as your environment grows.