AZ-305 Design infrastructure solutions Practice Question
Exhibit
{
"properties": {
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2021-02-01",
"name": "vnet-01",
"location": "[resourceGroup().location]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/16"
]
},
"subnets": [
{
"name": "subnet-a",
"properties": {
"addressPrefix": "10.0.0.0/24"
}
},
{
"name": "subnet-b",
"properties": {
"addressPrefix": "10.0.1.0/24",
"delegations": [
{
"name": "delegation",
"properties": {
"serviceName": "Microsoft.Web/serverFarms"
}
}
]
}
}
]
}
}
]
},
"parameters": {}
}
}Refer to the exhibit. You are reviewing an ARM template that deploys a virtual network with two subnets. Subnet-b includes a delegation to Microsoft.Web/serverFarms. What is the purpose of this delegation?
⚠ Common exam trap
Many exam-takers confuse subnet delegation with general VNet integration or peering, but delegation is specifically a resource provider permission model that allows a PaaS service (like App Service) to own and manage the subnet's network interfaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It enables Azure App Service instances to be deployed into subnet-b
Delegating a subnet to Microsoft.Web/serverFarms explicitly authorizes Azure App Service (specifically, the App Service Plan's infrastructure) to inject network interfaces into that subnet. This is required for features like regional VNet Integration, where an App Service instance needs direct access to resources in the virtual network without going through a public endpoint. Without this delegation, the App Service cannot use the subnet for its internal networking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It allows subnet-b to use a different address space
Why it's wrong here
Subnet address prefixes are governed by the subnet's own 'addressPrefix' (or 'addressPrefixes') property, which must fall within the parent virtual network's address space. A delegation entry only declares that the named Azure service is permitted to manage resources inside that subnet; it does not modify or expand the subnet's IP range. Selecting this option confuses IP allocation with the delegation's role.
- ✗
It configures a firewall policy for subnet-b
Why it's wrong here
Delegation simply hands operational control of the subnet to the service named in the 'serviceName' property, for example 'Microsoft.Web/serverFarms'. Azure Firewall policies are deployed as separate 'Microsoft.Network/firewallPolicies' resources and are attached to Azure Firewall instances or rule collection groups, not through subnet delegation. No firewall configuration is created or changed when a subnet is delegated, so this is an incorrect interpretation of the JSON.
- ✗
It creates a peering connection to another virtual network
Why it's wrong here
Virtual network peering requires an explicit 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings' resource that links two VNets by resource ID and configurations such as 'allowVirtualNetworkAccess'. A subnet delegation property is an array inside the subnet resource; it has no VNet-to-VNet connectivity semantics and cannot establish peering. Thus delegating subnet-b to a service has no effect on peering.
- ✓
It enables Azure App Service instances to be deployed into subnet-b
Why this is correct
With 'serviceName': 'Microsoft.Web/serverFarms', the delegation tells Azure that the subnet is reserved for App Service infrastructure, enabling an App Service plan or App Service Environment to deploy worker instances directly into subnet-b. The service then creates and manages the required network interfaces and permissions within that delegated subnet. This is the intended meaning of the delegation in the ARM template and the only option consistent with how subnet delegation works.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.