Hotspot Question You have an Azure subscription that contains a virtual network named VNet1. VNet1 has an IP address space of 10.0.0.0/16. You plan to configure a Bicep file to deploy an Azure…

Question

Exhibit

Answer Area

• Name:AzureFirewallManagementSubnet
  AzureApplicationGatewaySubnetAzureFirewallManagementSubnetAzureFirewallSubnetGatewaySubnet
• IP address space:10.0.1.0/26
  10.0.1.0/1610.0.1.0/2410.0.1.0/2610.0.1.0/28

Explanation

This question tests knowledge of Azure Firewall's required subnet naming conventions and minimum subnet size for the Firewall Management NIC feature. When enabling the Firewall Management NIC, Azure enforces specific requirements for the dedicated management subnet.

Approach. The Firewall Management NIC requires a subnet named exactly 'AzureFirewallManagementSubnet' - this is a hard requirement enforced by Azure and cannot be changed. The minimum required subnet size for the Azure Firewall Management NIC is /26, which provides 64 IP addresses (the same minimum as the main AzureFirewallSubnet). Within the VNet1 address space of 10.0.0.0/16, you would specify a /26 subnet such as 10.0.1.0/26 for the management subnet, using the minimum number of IP addresses while still meeting Azure's requirements. The main firewall subnet (AzureFirewallSubnet) also requires a minimum of /26, and the management subnet (AzureFirewallManagementSubnet) similarly requires /26 as its minimum size.

Concept tested. Azure Firewall Management NIC subnet requirements: the subnet must be named 'AzureFirewallManagementSubnet' and must have a minimum size of /26 (64 addresses). These are fixed Azure platform requirements that cannot be customized in a Bicep or ARM template.

Reference. https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#does-azure-firewall-support-forced-tunneling

No community discussion yet for this question.