Cascade Regional Airlines' network architects are provisioning a new Azure VNet for the crew-scheduling tier. The airline's on-premises data center already uses 10.10.0.0/16, and the VNet will connect to it over ExpressRoute. Which address space should the architects choose for the new VNet to avoid a routing conflict?
Select an answer to reveal the explanation.
Short Explanation
Think of IP address spaces like assigned parking zones: two networks can't share the same slots without cars colliding. Once Cascade connects on-prem to Azure over ExpressRoute, routes get exchanged between the two networks, so any overlap makes packets ambiguous about which side to reach. Picking a distinct non-overlapping block avoids that collision entirely.
Full Explanation
ExpressRoute and VNet-to-VNet connectivity both depend on unambiguous routing: a router can only forward a packet toward one destination for a given prefix, so if the on-premises 10.10.0.0/16 range and the new VNet share any addresses, traffic to those addresses becomes unroutable or gets delivered to the wrong side. 10.20.0.0/16 avoids this because it shares no bits of overlap with 10.10.0.0/16. The distractors fail for the same underlying reason expressed differently: reusing 10.10.0.0/16 outright is a full duplicate; carving 10.10.64.0/18 out of the existing range is still a subset of an address space already in use on-premises; and 10.0.0.0/8 is a supernet that mathematically contains 10.10.0.0/16, so it overlaps too, just from the other direction. The exam expects candidates to recognize overlap in both subset and superset form, not only exact duplicates. Before provisioning any new VNet that will peer or connect to an existing network, an architect should document the full IPAM (IP address management) plan and confirm the proposed CIDR block against every connected network's existing ranges, not just the most obvious one.