The organization plans significant growth for core services. Create the virtual network and subnets to accommodate existing resources and planned growth.

1. Sign in to the Azure portal.
2. Search for and select Virtual Networks, then select Create.
3. Complete the Basics tab for CoreServicesVnet:

   Option	Value
   Resource Group	<yourName>-mst400-F67-rg
   Name	CoreServicesVnet
   Region	(US) East US

4. On the IP Addresses tab, replace the IPv4 address space with 10.20.0.0/16.
5. Add the subnets (delete the default subnet before or after):

   Subnet	Starting address	Size
   SharedServicesSubnet	10.20.10.0	/24
   DatabaseSubnet	10.20.20.0	/24

6. Select Review + create, verify validation passed, and select Create.
7. After deployment, select Go to resource and verify the Address space and Subnets. Screenshot must show your Odl_user account, VNet overview pane with address space and subnets
8. Under Automation, select Export template, wait for generation, then Download the template.
9. On your machine, extract the downloaded zip so you have template.json and parameters.json.

Create ManufacturingVnet by editing the exported template. Manufacturing subnets are sized for expected growth.

1. Open template.json (from Task 1) in your editor (VS Code, trusted window).
2. Find & replace all occurrences:

   Find	Replace with
   CoreServicesVnet	ManufacturingVnet
   10.20.0.0	10.30.0.0
   SharedServicesSubnet	SensorSubnet1
   10.20.10.0/24	10.30.20.0/24
   DatabaseSubnet	SensorSubnet2
   10.20.20.0/24	10.30.21.0/24

3. Read back through the file, then save your changes.
4. Edit parameters.json: replace CoreServicesVnet with ManufacturingVnet, then save.
5. In the portal, search for Deploy a custom template → Build your own template in the editor → Load file.
6. Load your edited template.json, select Save, then Review + create and Create.
7. Wait for deployment, then confirm ManufacturingVnet and its subnets exist. Screenshot must show your Odl_user account, ManufacturingVnet overview with SensorSubnet1 and SensorSubnet2

In this task, create an Application Security Group (ASG) and a Network Security Group (NSG). The NSG will have an inbound rule that allows traffic from the ASG, and an outbound rule that denies internet access.

3a. Create the Application Security Group (ASG)

1. Search for and select Application security groups, then Create.
2. Configure and create the ASG:

   Setting	Value
   Subscription	your subscription
   Resource group	<yourName>-mst400-F67-rg
   Name	<yourName>-asg-web
   Region	East US

3b. Create the NSG and associate it with the subnet

1. Search for Network security groups, then + Create: Resource group <yourName>-mst400-F67-rg, Name <yourName>-NSGSecure, Region East US.
2. After deployment, Go to resource → Settings > Subnets → Associate.
3. Choose Virtual network CoreServicesVnet and Subnet SharedServicesSubnet, then OK.

3c. Inbound rule AllowASG

1. Under Settings > Inbound security rules, review the defaults (only other VNets and load balancers are allowed), then select + Add.
2. Add the rule, then select Add:

   Setting	Value
   Source	Application security group → <yourName>-asg-web
   Source port ranges	*
   Destination	Any
   Destination port ranges	80,443
   Protocol	TCP
   Action	Allow
   Priority	100
   Name	AllowASG

3d. Outbound rule DenyAnyCustom8080Outbound

1. Open Outbound security rules and notice AllowInternetOutboundRule (priority 65001, cannot be deleted).
2. Select + Add and configure:

   Setting	Value
   Source	Any
   Source port ranges	*
   Destination	Service tag → Internet
   Destination port ranges	8080
   Protocol	Any
   Action	Deny
   Priority	4096
   Name	DenyAnyCustom8080Outbound

3. Verify both rules appear in the NSG. Screenshot must show your Odl_user account, the NSG inbound rule (AllowASG) and outbound rule (DenyAnyCustom8080Outbound)

4a. Public DNS zone

1. Search for and select DNS zones, then + Create.
2. Configure: Resource group <yourName>-mst400-F67-rg, Name yourName.com (adjust if reserved), Region East US. Review create → Create.
3. Go to resource, note the four Azure DNS name servers, and copy one address for later.
4. Select + Record set and add:

   Property	Value
   Name	www
   Type	A
   TTL	1
   IP address	10.1.1.4

5. Run nslookup www.yourName.com <name server name> and verify it resolves to 10.1.1.4. Screenshot must show your Odl_user account, the nslookup command resolving www.yourName.com to 10.1.1.4

4b. Private DNS zone

1. Search for and select Private DNS zones, then + Create.
2. Configure: Resource group <yourName>-mst400-F67-rg, Name private.yourName.com, Region East US. Review create → Create.
3. Go to resource → Virtual network links → + Add: Link name manufacturing-link, Virtual network ManufacturingVnet.
4. From Overview, select + Record set and add:

   Property	Value
   Name	sensorvm
   Type	A
   TTL	1
   IP address	10.1.1.4

5. Verify the record set appears in the private zone. Screenshot must show your Odl_user account, the sensorvm record set in the private DNS zone

Minimum 2-3 sentences each — original thinking, your own words!

1. Describe the main focus of this lab and outline the new skills or concepts you learned.
2. What challenges did you encounter during this lab, and how did you overcome them?
3. How do the tasks performed in this lab enhance your understanding of Azure networking?
4. In what ways can you apply the knowledge gained from this lab to real-world scenarios? Provide specific examples.

Screenshots you attach above and your Task 5 answers appear here. This is exactly what prints/exported as your PDF.

1. All screenshots attached in task order, each with your Odl_user account visible (underlined or highlighted).
2. A brief explanation added for each screenshot.
3. Export the PDF with Print / Save as PDF and upload it to the Blackboard assignment.