An Azure VNet has the IP network 10.0.0.0/16 with two subnets, 10.0.1.0/24 (used for web servers) and 10.0.2.0/24 (used for database servers). Which is a valid IP address to manage the VM-Series NGFW?

Question

Options

• A10.0.1.254
• B10.0.2.1
• C10.0.3.255
• D10.0.3.1

• A
  4% (1)
• B
  4% (1)
• C
  13% (3)
• D
  79% (19)

Explanation

D (10.0.3.1) is correct because the VM-Series NGFW management interface should reside on a dedicated management subnet, separate from production workloads. The address 10.0.3.1 falls within the 10.0.0.0/16 VNet space but in a new subnet (10.0.3.0/24) not used by web or database servers - exactly the isolation best practice requires.

A (10.0.1.254) is wrong because it places management traffic on the web server subnet, violating the principle of separating management from data plane traffic - a security risk and an architectural anti-pattern. B (10.0.2.1) fails for the same reason: it shares the database subnet, mixing management with sensitive backend traffic. C (10.0.3.255) is invalid because .255 is the broadcast address of a /24 subnet and can never be assigned to a host interface.

Memory tip: Think "Management needs its Mown subnet, and .255 is Meant for broadcasts." If the answer places the firewall's management interface on an existing production subnet, eliminate it - and always disqualify .255 in any /24 context.

No community discussion yet for this question.