4.1 - Virtual networks, subnets and Azure DNS
AZ-104 objective 4.1 covers virtual networks, subnets and name resolution. A virtual network is private address space you carve into subnets; subnets in the same VNet cannot use overlapping address ranges, the smallest subnet Azure allows is a /29, and Azure reserves the first four addresses and the last address in every subnet, so in 10.0.1.0/24 the first IP actually assigned to a VM is 10.0.1.4. Moving a running VM to another subnet in the same VNet is a change to its NIC configuration, and certain services, such as Azure Bastion or an App Service integration, must run inside a delegated subnet. For name resolution, Azure-provided DNS resolves hostnames within a single VNet automatically, while an Azure Private DNS zone lets VMs across your networks resolve each other by hostname using your own domain; with autoregistration enabled, DNS records are created for VMs automatically, and a peered VNet must be explicitly linked to the private zone before it can resolve those names. Public-facing records, such as an MX record that routes email for a domain, live in a public DNS zone. Expect scenarios that ask which addressing, subnet or DNS option fits.
Azure reserves 5 IPs per subnet, so .4 is the first usable; smallest subnet is /29. Resolve VMs by your own hostname = Private DNS zone with autoregistration; a peer must be linked. MX record routes mail from a public zone.
Practice questions
1. You need name resolution so VMs across your virtual networks can reach each other by hostname using your own domain. What should you deploy?
- An Azure private DNS zone (correct answer)
- A public Azure DNS zone hosting the internet-facing records for the company's registered domain
- A NAT gateway
- An NSG rule
An Azure private DNS zone provides name resolution within and across linked VNets without exposing records to the internet. A public DNS zone answers internet queries, a NAT gateway handles outbound connectivity, and an NSG filters traffic.
2. Azure reserves a fixed number of IP addresses in every subnet that you cannot assign to your own resources. How many?
- Five per subnet (correct answer)
- Only two, reserved for the network address and the broadcast address of that subnet
- Zero, since Azure lets you freely use every address in the range
- Three per subnet
Azure reserves five addresses in each subnet: the network address, the default gateway, two for Azure DNS mapping, and the broadcast address. So a subnet always has five fewer usable hosts than its raw size.
3. What is the smallest subnet size that Azure will let you create inside a virtual network?
- A /29 subnet (correct answer)
- A /24 subnet, because Azure refuses to create anything smaller than 256 total addresses
- A /30 subnet
- A /28 subnet
The smallest supported subnet is /29, which has 8 total addresses. After Azure reserves 5, that leaves 3 usable hosts. Anything smaller such as /30 is not allowed.
4. In the subnet 10.0.1.0/24, what is the first IP address that Azure will actually assign to one of your VMs?
- 10.0.1.4 (correct answer)
- 10.0.1.1, which Azure has already reserved as the default gateway of the subnet
- 10.0.1.0
- 10.0.1.2
Azure reserves .0 (network), .1 (gateway), .2 and .3 (DNS). The first address available to your resources is therefore .4, here 10.0.1.4.
5. How is a virtual network's address space defined when you create the VNet?
- In CIDR notation such as 10.0.0.0/16 (correct answer)
- As a pair of start and end host names that you register in your public DNS zone first
- As a single host IP address
- As a range of TCP port numbers
A VNet address space is expressed in CIDR notation, for example 10.0.0.0/16, which sets the block of private IPs available for its subnets. Host names, single IPs, and port ranges do not define address space.
6. A virtual network is running out of address space. Can you give it more without recreating it?
- Yes, you can add address ranges to the VNet (correct answer)
- No, the address space is permanent, so you must delete and rebuild the entire virtual network from scratch
- Only by deleting a subnet first
- Only through a VPN gateway
You can add additional address ranges to an existing VNet at any time, as long as they do not overlap other ranges or peered networks. Deleting the whole VNet is unnecessary.