Subnets within a VNet in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a subnet in the context of an Azure Virtual Network (VNet)?

A subnet is a smaller network segment within a Virtual Network (VNet) that divides the VNet's IP address space into smaller, manageable sections. It helps organize and secure resources by grouping them logically.

beginner

Why do we use subnets inside a VNet?

Subnets help separate resources for security, control traffic flow, and organize resources by function or department. They also allow applying network security rules and routing policies at a smaller scale.

intermediate

How does the IP address range of a subnet relate to the VNet's IP address range?

The subnet's IP address range must be a subset of the VNet's IP address range. This means the subnet's addresses come from the larger pool defined by the VNet.

beginner

Can subnets in the same VNet communicate with each other by default?

Yes, subnets within the same VNet can communicate with each other by default without extra configuration, unless network security groups or other rules block the traffic.

intermediate

What is a Network Security Group (NSG) and how does it relate to subnets?

A Network Security Group (NSG) is a set of security rules that control inbound and outbound traffic. NSGs can be applied to subnets to control traffic for all resources inside that subnet.

What must a subnet's IP range be in relation to its VNet's IP range?

A A subset of the VNet's IP range

B Completely outside the VNet's IP range

C Exactly the same as the VNet's IP range

D Larger than the VNet's IP range

A subnet's IP range must be a subset of the VNet's IP range to fit inside the larger network.

By default, can resources in different subnets within the same VNet communicate?

A No, they are isolated by default

B Yes, without extra configuration

C Only if they share the same IP address

D Only if they are in different VNets

Subnets within the same VNet can communicate by default unless blocked by security rules.

What Azure feature can you use to control traffic to and from a subnet?

A Azure Blob Storage

B Virtual Machine Scale Set

C Network Security Group (NSG)

D Azure Functions

Network Security Groups (NSGs) allow you to set rules controlling traffic at the subnet level.

What is the main purpose of dividing a VNet into subnets?

A To create multiple VNets

B To increase internet speed

C To reduce storage costs

D To organize and secure resources

Subnets help organize resources and apply security controls within a VNet.

Which of the following is true about subnets in Azure VNets?

A They share the VNet's address space but have their own smaller ranges

B They must have overlapping IP ranges

C They cannot have any security rules applied

D They are completely independent networks

Subnets use smaller IP ranges within the VNet's overall address space.

Explain what a subnet is and why it is used inside an Azure Virtual Network.

Think about how a big neighborhood is divided into smaller blocks.

Describe how Network Security Groups (NSGs) work with subnets in Azure.

Imagine a security guard controlling who enters or leaves a block.

Practice

1. What is the main purpose of creating subnets within a Virtual Network (VNet) in Azure?

easy

A. To create virtual machines directly inside the VNet

B. To divide the VNet into smaller IP address ranges for better organization and security

C. To connect different VNets together automatically

D. To increase the total IP address space of the VNet

Solution

1. Step 1: Understand the role of subnets in a VNet

   Subnets split a VNet into smaller parts, each with its own IP range.

2. Step 2: Identify the purpose of subnetting

   Subnetting helps organize resources and apply security rules within the VNet.

3. Final Answer:

   To divide the VNet into smaller IP address ranges for better organization and security -> Option B

4. Quick Check:

   Subnet purpose = divide and organize IP ranges [OK]

Hint: Subnets split IP space inside a VNet for organization [OK]

Common Mistakes:

• Thinking subnets increase total IP space
• Confusing subnets with VNet peering
• Believing subnets create VMs automatically

2. Which of the following is the correct way to define a subnet within an Azure VNet using CIDR notation?

easy

A. 10.0.1.0/24

B. 10.0.0.256/24

C. 10.0.0.0/16

D. 10.0.0.0/33

Solution

1. Step 1: Review valid CIDR notation for subnets

   CIDR notation uses an IP address and a prefix length between 0 and 32 for IPv4.

2. Step 2: Check each option for validity

   10.0.0.0/16 is a VNet range, not a subnet. 10.0.1.0/24 is a valid subnet inside 10.0.0.0/16. 10.0.0.256/24 has an invalid IP (256 is out of range). 10.0.0.0/33 has an invalid prefix length (33 is too large).

3. Final Answer:

   10.0.1.0/24 -> Option A

4. Quick Check:

   Valid subnet CIDR = 10.0.1.0/24 [OK]

Hint: Subnet CIDR must have valid IP and prefix ≤ 32 [OK]

Common Mistakes:

• Using IP octets above 255
• Using prefix length greater than 32
• Confusing VNet and subnet CIDR sizes

3. Given a VNet with address space 192.168.0.0/16, which subnet CIDR block is valid and fits inside this VNet?

medium

A. 192.168.1.0/24

B. 192.169.0.0/24

C. 192.168.0.0/15

D. 10.0.0.0/24

Solution

1. Step 1: Understand the VNet address space

   The VNet covers IPs from 192.168.0.0 to 192.168.255.255 (a /16 block).

2. Step 2: Check which subnet fits inside the VNet

   192.168.1.0/24 (192.168.1.0/24) fits inside the VNet range. 192.169.0.0/24 is outside the 192.168.x.x range. 192.168.0.0/15 has a /15 prefix which is larger than the VNet's /16, so it extends outside. 10.0.0.0/24 is a different private IP range.

3. Final Answer:

   192.168.1.0/24 -> Option A

4. Quick Check:

   Subnet inside VNet range = 192.168.1.0/24 [OK]

Hint: Subnet must be fully inside VNet IP range [OK]

Common Mistakes:

• Choosing subnet outside VNet range
• Using larger prefix than VNet
• Confusing private IP ranges

4. You tried to create a subnet with CIDR 10.1.0.0/16 inside a VNet with address space 10.0.0.0/24. What is the problem?

medium

A. The subnet CIDR is invalid because it uses a private IP range

B. The subnet CIDR is too small for a subnet

C. The subnet CIDR overlaps with another subnet

D. The subnet CIDR is larger than the VNet address space and does not fit inside

Solution

1. Step 1: Compare subnet and VNet address spaces

   The VNet covers 10.0.0.0 to 10.0.0.255 (/24). The subnet 10.1.0.0/16 covers 10.1.0.0 to 10.1.255.255, which is outside the VNet range.

2. Step 2: Identify the error

   The subnet CIDR must be fully inside the VNet's address space. Here, it is larger and outside the VNet.

3. Final Answer:

   The subnet CIDR is larger than the VNet address space and does not fit inside -> Option D

4. Quick Check:

   Subnet must fit inside VNet range [OK]

Hint: Subnet CIDR must be inside VNet CIDR, not bigger [OK]

Common Mistakes:

• Ignoring subnet size vs VNet size
• Thinking private IP ranges are invalid
• Assuming overlap without checking

5. You have a VNet with address space 172.16.0.0/16. You want to create three subnets: 172.16.0.0/18, 172.16.64.0/18, and 172.16.128.0/17. Which statement is true about these subnets?

hard

A. The second subnet is outside the VNet address space

B. The third subnet overlaps with the first two subnets

C. All three subnets fit inside the VNet without overlapping

D. The subnet sizes are invalid for this VNet

Solution

1. Step 1: Analyze the VNet and subnet ranges

   The VNet covers 172.16.0.0 to 172.16.255.255 (/16). The first subnet covers 172.16.0.0 to 172.16.63.255 (/18). The second covers 172.16.64.0 to 172.16.127.255 (/18). The third covers 172.16.128.0 to 172.16.255.255 (/17).

2. Step 2: Check for overlaps

   The subnets cover distinct ranges: first 172.16.0.0-172.16.63.255, second 172.16.64.0-172.16.127.255, third 172.16.128.0-172.16.255.255. No overlaps, all fit within the VNet.

3. Final Answer:

   All three subnets fit inside the VNet without overlapping -> Option C

4. Quick Check:

   All three subnets fit without overlapping [OK]

Hint: Check subnet ranges carefully for overlaps [OK]

Common Mistakes:

• Miscalculating subnet ranges and thinking they overlap
• Confusing prefix lengths and their sizes
• Ignoring subnet boundaries