AZ-305 Question 225
Single answerYou manage a set of virtual machines (VMs) in an Azure Virtual Network that must reach third-party web services on the internet. You also need to ensure that all outbound connections from these VMs appear to come from a single, consistent public IP address. Which Azure service should you recommend to meet these requirements?
- A
Use an Azure Virtual Network NAT Gateway
- B
Use an Azure Application Gateway in front of the virtual machines
- C
Configure a Site-to-Site VPN connection with an on-premises environment
- D
Deploy a Standard Public Load Balancer with outbound rules
Show answer and explanation
Correct answer: A
Explanation
When Azure VMs need to connect to external services with a consistent public IP address, the recommended approach is to use an Azure Virtual Network NAT Gateway. It simplifies outbound NAT and ensures a predictable egress IP address. Refer to Microsoft’s documentation ('Use a NAT gateway for outbound connections' - docs.microsoft.com) for best practices on configuring NAT Gateways in Azure.
- A. Correct.
Option A: Use an Azure Virtual Network NAT Gateway. This is correct because a NAT Gateway is specifically designed to provide outbound internet connectivity with a single, consistent public IP address for resources in an Azure Virtual Network. It simplifies outbound NAT rules and allows for more predictable egress IPs.
- B. Incorrect.
Option B: Use an Azure Application Gateway in front of the virtual machines. This is incorrect because Application Gateway primarily handles Layer 7 web traffic (HTTP/HTTPS). It can manage inbound connections and perform tasks like SSL offloading or path-based routing, but it is not intended for general outbound internet connectivity with a single public IP.
- C. Incorrect.
Option C: Configure a Site-to-Site VPN connection with an on-premises environment. This is incorrect because a VPN Gateway is meant to securely tunnel traffic between Azure and on-premises networks. It does not provide a dedicated single public IP for outbound internet traffic.
- D. Incorrect.
Option D: Deploy a Standard Public Load Balancer with outbound rules. While a Standard Load Balancer can provide outbound scenarios, it does not offer as simplified or reliable a method of assigning consistent outbound IP addresses as NAT Gateway does. NAT Gateway is the recommended best practice for outbound connections.