Subnets & IP Planning
Where resources actually land, and where delegation, service endpoints and reserved names change what a subnet can host.
Readiness
0%
2h baseline
Exam memorization points
- Five addresses per subnet are reserved by the platform, so the usable host count is 2^(32-prefix) - 5.
- Reserved subnet names matter: GatewaySubnet for VPN and ExpressRoute gateways, AzureBastionSubnet for Azure Bastion, AzureFirewallSubnet for Azure Firewall.
- AzureBastionSubnet must be at least /26, while GatewaySubnet is commonly recommended as /27 or larger.
- Subnet delegation hands a subnet to a PaaS service, for example Microsoft.Web/serverFarms for App Service VNet integration.
- Service endpoints extend the VNet identity of a subnet to a PaaS public endpoint; private endpoints instead place a NIC with a private IP in the subnet.
- Route tables and network security groups are associated with subnets, not with individual VMs.
Traps & distractors
- Naming the gateway subnet anything other than GatewaySubnet, which makes the gateway deployment fail.
- Sizing AzureBastionSubnet smaller than /26 - a frequent exam distractor.
- Assuming a subnet CIDR can be edited while resources exist. It generally cannot; plan address space up front.
- Delegating a subnet and then trying to deploy a VM there - delegated subnets are reserved for the delegated service.
- Confusing service endpoints (public endpoint plus firewall) with private endpoints (private IP plus private DNS).
Suggested lab
Build the standard landing subnet set
Practise the naming and sizing rules that the exam tests directly.
- 1In your VNet, create AzureBastionSubnet as /26 and GatewaySubnet as /27.
- 2Add a NAT Gateway and associate it with the workload subnet, then check the outbound public IP.
- 3Create a second VNet and a subnet delegated to Microsoft.Web/serverFarms.
- 4Try to deploy a VM into the delegated subnet and record the failure.
- 5Convert a service endpoint on the workload subnet for Microsoft.Storage into a private endpoint and compare addresses.
Microsoft Learn
- Virtual network subnetsdoc
- Search Microsoft Learn: subnet delegation service endpoints reserved subnet names AzureBastionSubnetsearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage73% × 20% = 14.6
11 later topics depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
11 topics downstream in total.
Baseline study time
2h
Complexity
3 / 5
Remaining to target
1h 42m
Status weight
0%
Topics: subnet, cidr, delegation, service endpoint, gateway subnet, bastion subnet
Weak neighbours in Networking