AZ-700 Question 8
Select 2You are designing a single virtual network for your organization to host several Azure services: a site-to-site VPN gateway, an Azure Bastion instance for secure VM access, an Azure Firewall for traffic inspection, and a private endpoint for Azure SQL Database. The design should follow Microsoft� best practices while minimizing the number of subnets. Which two subnet configurations should you implement?
- A
- Create a single subnet named 'ManagementSubnet' with a /24 prefix and deploy the VPN gateway, Bastion, Firewall, and the private endpoint in that subnet.
- B
- Deploy a dedicated 'GatewaySubnet' for the site-to-site VPN gateway and a dedicated 'AzureBastionSubnet' for Azure Bastion, but place Azure Firewall and the private endpoint in the same new subnet named 'FirewallPrivateSubnet'.
- C
- Deploy a dedicated 'GatewaySubnet' for the VPN gateway, a dedicated 'AzureBastionSubnet' for Azure Bastion, a dedicated 'AzureFirewallSubnet' for the Firewall, and place the private endpoint in an existing application subnet.
- D
- Deploy a dedicated 'GatewaySubnet' for the VPN gateway, a dedicated 'AzureBastionSubnet' for Azure Bastion, a dedicated 'AzureFirewallSubnet' for the Firewall, and a new subnet specifically for the private endpoint.
Show answer and explanation
Correct answers: C, D
Explanation
Both VPN gateways and Azure Bastion require dedicated subnets named 'GatewaySubnet' and 'AzureBastionSubnet' respectively. Azure Firewall also requires its own dedicated 'AzureFirewallSubnet'. Private endpoints can be placed in an existing subnet, provided that network policies such as service endpoints or network security group rules are correctly configured. In some scenarios, security or governance requirements may justify an entirely dedicated subnet for private endpoints, while other scenarios may place them in existing subnets to minimize IP overhead. Refer to Microsoft documentation on Azure VNet service constraints (https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-subnet#subnet-constraints) for details on subnet requirements for each resource.
- A. Incorrect.
Option 1: Incorrect. Azure Bastion, Azure Firewall, and the VPN gateway each require their own dedicated subnet. Placing all services in a single subnet violates Azure� requirement for dedicated subnets, particularly for Bastion and Firewall.
- B. Incorrect.
Option 2: Incorrect. While creating separate subnets for the gateway and Bastion is correct, Azure Firewall also requires its own subnet named 'AzureFirewallSubnet'. Combining the Firewall and the private endpoint in a single subnet is not a recommended practice.
- C. Correct.
Option 3: Correct. Each service (VPN gateway, Bastion, Firewall) is placed in its dedicated subnet according to Azure requirements. Private endpoints can reside in an existing application subnet if it is properly configured, minimizing the creation of additional subnets.
- D. Correct.
Option 4: Correct. This option follows all best practices by providing dedicated subnets for the VPN gateway, Bastion, and Firewall, plus a segregated subnet for the private endpoint if further isolation is desired.