Subnets within a VNet in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

Subnet IP Range Overlap in Azure VNet

You create a Virtual Network (VNet) with address space 10.0.0.0/16. You then add two subnets:

• Subnet A: 10.0.1.0/24
• Subnet B: 10.0.1.128/25

What will happen when you try to deploy this configuration?

A Deployment succeeds; both subnets coexist without issues.

B Deployment fails due to overlapping IP address ranges between subnets.

C Deployment succeeds but Subnet B will be automatically resized to avoid overlap.

D Deployment succeeds but Subnet A will be deleted automatically.

💡 Hint

Think about whether subnet IP ranges can overlap inside a VNet.

Azure does not allow overlapping IP address ranges for subnets within the same VNet. Subnet B's range 10.0.1.128/25 overlaps with Subnet A's 10.0.1.0/24, causing deployment failure.

❓ service_behavior

intermediate

Subnet Delegation Impact on Resource Deployment

You create a subnet within a VNet and delegate it to Microsoft.Web/serverFarms (App Service). What is the effect of this delegation?

A The subnet is reserved for the delegated service and cannot host other resources.

B The subnet automatically scales based on the delegated service's needs.

C Delegation has no effect on resource deployment in the subnet.

D The subnet can only host virtual machines after delegation.

💡 Hint

Consider what subnet delegation means for resource placement.

Subnet delegation reserves the subnet for the specified Azure service, preventing other resource types from being deployed there.

❓ security

advanced

Network Security Group (NSG) Application Scope

You associate a Network Security Group (NSG) with a subnet inside a VNet. Which of the following statements is true about the NSG's effect?

A The NSG rules apply only to virtual machines directly attached to the subnet.

B The NSG rules apply only to inbound traffic at the subnet boundary, not outbound traffic.

C The NSG rules apply to all network interfaces within the subnet, including VMs and PaaS resources.

D The NSG rules apply only if the subnet has delegation enabled.

💡 Hint

Think about what resources are affected by NSG rules when applied to a subnet.

When an NSG is associated with a subnet, its rules apply to all network interfaces within that subnet, affecting both inbound and outbound traffic for all attached resources.

❓ Configuration

advanced

Azure CLI Command to Create a Subnet

Which Azure CLI command correctly creates a subnet named 'backend' with address prefix 10.0.2.0/24 inside an existing VNet 'myVNet' in resource group 'myRG'?

A az network vnet subnet create --resource-group myRG --vnet-name myVNet --name backend --address-prefix 10.0.2.0/24

B az network vnet create --resource-group myRG --name backend --address-prefix 10.0.2.0/24 --vnet-name myVNet

C az network subnet create --resource-group myRG --vnet myVNet --name backend --address 10.0.2.0/24

D az subnet create --resource-group myRG --vnet-name myVNet --name backend --address-prefix 10.0.2.0/24

💡 Hint

Recall the Azure CLI command structure for subnet creation.

The correct command is az network vnet subnet create with parameters for resource group, VNet name, subnet name, and address prefix.

✅ Best Practice

expert

Designing Subnets for High Availability and Security

You are designing a VNet with multiple subnets for a multi-tier application. Which subnet design best follows Azure best practices for high availability and security?

1. One subnet for all resources.
2. Separate subnets for web, application, and database tiers with NSGs applied per subnet.
3. Separate subnets for each VM with no NSGs.
4. One subnet per region with all tiers mixed inside.

A Option 4: One subnet per region with all tiers mixed inside.

B Option 1: One subnet for all resources.

C Option 3: Separate subnets for each VM with no NSGs.

D Option 2: Separate subnets for web, application, and database tiers with NSGs applied per subnet.

💡 Hint

Think about isolation and control of traffic between tiers.

Separating tiers into different subnets and applying NSGs per subnet allows better control of traffic flow and improves security and availability.

Practice

1. What is the main purpose of creating subnets within a Virtual Network (VNet) in Azure?

easy

A. To create virtual machines directly inside the VNet

B. To divide the VNet into smaller IP address ranges for better organization and security

C. To connect different VNets together automatically

D. To increase the total IP address space of the VNet

Solution

1. Step 1: Understand the role of subnets in a VNet

   Subnets split a VNet into smaller parts, each with its own IP range.

2. Step 2: Identify the purpose of subnetting

   Subnetting helps organize resources and apply security rules within the VNet.

3. Final Answer:

   To divide the VNet into smaller IP address ranges for better organization and security -> Option B

4. Quick Check:

   Subnet purpose = divide and organize IP ranges [OK]

Hint: Subnets split IP space inside a VNet for organization [OK]

Common Mistakes:

• Thinking subnets increase total IP space
• Confusing subnets with VNet peering
• Believing subnets create VMs automatically

2. Which of the following is the correct way to define a subnet within an Azure VNet using CIDR notation?

easy

A. 10.0.1.0/24

B. 10.0.0.256/24

C. 10.0.0.0/16

D. 10.0.0.0/33

Solution

1. Step 1: Review valid CIDR notation for subnets

   CIDR notation uses an IP address and a prefix length between 0 and 32 for IPv4.

2. Step 2: Check each option for validity

   10.0.0.0/16 is a VNet range, not a subnet. 10.0.1.0/24 is a valid subnet inside 10.0.0.0/16. 10.0.0.256/24 has an invalid IP (256 is out of range). 10.0.0.0/33 has an invalid prefix length (33 is too large).

3. Final Answer:

   10.0.1.0/24 -> Option A

4. Quick Check:

   Valid subnet CIDR = 10.0.1.0/24 [OK]

Hint: Subnet CIDR must have valid IP and prefix ≤ 32 [OK]

Common Mistakes:

• Using IP octets above 255
• Using prefix length greater than 32
• Confusing VNet and subnet CIDR sizes

3. Given a VNet with address space 192.168.0.0/16, which subnet CIDR block is valid and fits inside this VNet?

medium

A. 192.168.1.0/24

B. 192.169.0.0/24

C. 192.168.0.0/15

D. 10.0.0.0/24

Solution

1. Step 1: Understand the VNet address space

   The VNet covers IPs from 192.168.0.0 to 192.168.255.255 (a /16 block).

2. Step 2: Check which subnet fits inside the VNet

   192.168.1.0/24 (192.168.1.0/24) fits inside the VNet range. 192.169.0.0/24 is outside the 192.168.x.x range. 192.168.0.0/15 has a /15 prefix which is larger than the VNet's /16, so it extends outside. 10.0.0.0/24 is a different private IP range.

3. Final Answer:

   192.168.1.0/24 -> Option A

4. Quick Check:

   Subnet inside VNet range = 192.168.1.0/24 [OK]

Hint: Subnet must be fully inside VNet IP range [OK]

Common Mistakes:

• Choosing subnet outside VNet range
• Using larger prefix than VNet
• Confusing private IP ranges

4. You tried to create a subnet with CIDR 10.1.0.0/16 inside a VNet with address space 10.0.0.0/24. What is the problem?

medium

A. The subnet CIDR is invalid because it uses a private IP range

B. The subnet CIDR is too small for a subnet

C. The subnet CIDR overlaps with another subnet

D. The subnet CIDR is larger than the VNet address space and does not fit inside

Solution

1. Step 1: Compare subnet and VNet address spaces

   The VNet covers 10.0.0.0 to 10.0.0.255 (/24). The subnet 10.1.0.0/16 covers 10.1.0.0 to 10.1.255.255, which is outside the VNet range.

2. Step 2: Identify the error

   The subnet CIDR must be fully inside the VNet's address space. Here, it is larger and outside the VNet.

3. Final Answer:

   The subnet CIDR is larger than the VNet address space and does not fit inside -> Option D

4. Quick Check:

   Subnet must fit inside VNet range [OK]

Hint: Subnet CIDR must be inside VNet CIDR, not bigger [OK]

Common Mistakes:

• Ignoring subnet size vs VNet size
• Thinking private IP ranges are invalid
• Assuming overlap without checking

5. You have a VNet with address space 172.16.0.0/16. You want to create three subnets: 172.16.0.0/18, 172.16.64.0/18, and 172.16.128.0/17. Which statement is true about these subnets?

hard

A. The second subnet is outside the VNet address space

B. The third subnet overlaps with the first two subnets

C. All three subnets fit inside the VNet without overlapping

D. The subnet sizes are invalid for this VNet

Solution

1. Step 1: Analyze the VNet and subnet ranges

   The VNet covers 172.16.0.0 to 172.16.255.255 (/16). The first subnet covers 172.16.0.0 to 172.16.63.255 (/18). The second covers 172.16.64.0 to 172.16.127.255 (/18). The third covers 172.16.128.0 to 172.16.255.255 (/17).

2. Step 2: Check for overlaps

   The subnets cover distinct ranges: first 172.16.0.0-172.16.63.255, second 172.16.64.0-172.16.127.255, third 172.16.128.0-172.16.255.255. No overlaps, all fit within the VNet.

3. Final Answer:

   All three subnets fit inside the VNet without overlapping -> Option C

4. Quick Check:

   All three subnets fit without overlapping [OK]

Hint: Check subnet ranges carefully for overlaps [OK]

Common Mistakes:

• Miscalculating subnet ranges and thinking they overlap
• Confusing prefix lengths and their sizes
• Ignoring subnet boundaries