nerdexam
Microsoft

AZ-700 · Question #214

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains the following subnets: - AzureFirewallSubnet - GatewaySubnet - Subnet1 - Subnet2 - Subnet3 Subnet2 has a…

The correct answer is E. Subnet3. Azure Application Gateway requires a dedicated subnet - it cannot share a subnet with any other resources or services. The constraints eliminate the other options: GatewaySubnet is reserved exclusively for VPN and ExpressRoute gateways (Azure enforces this). AzureFirewallSubnet…

Submitted by helene.fr· Apr 18, 2026

Question

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains the following subnets:

  • AzureFirewallSubnet
  • GatewaySubnet
  • Subnet1
  • Subnet2
  • Subnet3

Subnet2 has a delegation to the Microsoft.Web/serverfarms service. The subscription contains the resources shown in the following table. You need to implement an Azure application gateway named AG1 that will be integrated with an Azure Web Application Firewall (WAF). AG1 will be used to publish VMSS1. To which subnet should you connect AG1?

Options

  • AGatewaySubnet
  • BAzureFirewallSubnet
  • CSubnet2
  • DSubnet1
  • ESubnet3

How the community answered

(21 responses)
  • A
    5% (1)
  • C
    5% (1)
  • D
    10% (2)
  • E
    81% (17)

Explanation

Azure Application Gateway requires a dedicated subnet - it cannot share a subnet with any other resources or services. The constraints eliminate the other options: GatewaySubnet is reserved exclusively for VPN and ExpressRoute gateways (Azure enforces this). AzureFirewallSubnet is reserved exclusively for Azure Firewall. Subnet2 has a delegation to Microsoft.Web/serverfarms (App Service Environment), which means it is already committed to that service and cannot host an Application Gateway. Subnet1 likely already has existing resources such as VMSS1 deployed to it (Application Gateway must be in a dedicated subnet with no other resources). Subnet3 is the only subnet that is unencumbered and available for the Application Gateway with WAF.

Community Discussion

No community discussion yet for this question.

Full AZ-700 Practice