CIDR maths with a clock chasing you. Azure quietly steals five addresses from every subnet — and the exam absolutely knows it.
—
Azure reserves 5 addresses per subnet, not 2:
x.x.x.0 network id, .1 default gateway, .2 and .3 Azure DNS mapping,
and the final address as broadcast. Usable = 2(32−prefix) − 5. That single line is worth several exam questions.
…
Every row links to the whiteboard that covers it.
Item types in the rotation, and the board that fixes each weakness.
The four that kill people: (1) subtracting 2 instead of 5;
(2) forgetting GatewaySubnet / AzureFirewallSubnet / AzureBastionSubnet
must be named exactly that, with no other resources in them;
(3) assuming peering is transitive; (4) planning overlapping address space with on-prem, which quietly
removes VPN/ExpressRoute and peering from the table forever.