Exam AZ-305 topic 4 question 111 discussion

Box 1: 2 subnets Create a virtual network that contains at least 2 subnets. One for the Azure App Service VNet Integration and another for the Azure Private Link. Box 2: a private DNS zone Configure name resolution to use a private DNS zone. This is necessary for the web app to work with Azure DNS private zones.

People that respond in here never used Azure. You need Virtual network integration for a Web App to talk with a service inside a Vnet. And you need a different subnet for the SQL Private endpoint. So you need at the very least 2 subnets to have this working

i would argue that second box is azure private dns resolver. yes, you do need a private dns zone to integrate the SQL PE, however thw question is what do you need to configure on VNET level. so on vnet, the dns servers has two options: azure-provided and custom. on custom, you can only add IPs. private DNS zones are FQDN based. so, my take is that NOTHING should be changed at VNET level (and leave the default zure private dns resolver. in place), as long as the private DNS zone is linked to the VNET already

WRONG 2 Subnets A private DNS zone

2 Subnets - vNET integration + Private EP (Note subnet is not dedicated to EP and can be other subnet but not Integration subnet hence another subnet must be provisioned), Private EP require private DNS in this scenario

Box1: 2 VNETs Box2: Private DNS zone I have been working with PE/PLs for the past 3 years, so MS tells us that PEs don't go along with delegated subnets as in this case with the webapp and the SQL PE. Any Subnet that has been delegated (as in webapp VNET integration), doesn't support to have a PE inside it. https://learn.microsoft.com/en-us/azure/virtual-network/subnet-delegation-overview#effect-of-subnet-delegation-on-your-subnet "Each Azure service defines their own deployment model, where they can define what properties they do or don't support in a delegated subnet for injection purposes as follows: Can't be used with a private endpoint if the subnet is delegated."

Azure App Service VNet Integration required dedicated subnet and we need second subnet for IP address of Private Link.

This is a nasty question. 1 subnet would be sufficient if the App only needs inbound traffic, because Private Endpoints only support Inbound traffic - "Private endpoint is only used for incoming traffic to your app. Outgoing traffic won't use this private endpoint. You can inject outgoing traffic to your network in a different subnet through the virtual network integration feature." - https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint So you need Virtual Network Integration as well as a private endpoint for the app, to enable the app to talk to the database. For example, see https://gregorsuttie.com/2023/01/16/azure-web-app-using-azure-sql-using-private-endpoints/

2 subnets. one for the DB and one for the app service. https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#subnet-requirements

given answer is correct.

Correct answer. 1 subnet and Private DNS zone.