AZ-305 Question 226
Single answerA company has multiple virtual machines running in a single Azure Virtual Network (VNet). The organization wants these VMs to access the internet for software updates and external web services, but does not want any external inbound connections directly reaching the VMs. They also want to simplify management of outbound connections and reduce the number of public IP addresses. Which Azure service would best meet these requirements?
- A
Assign a Public IP address to each VM and enable Network Security Groups
- B
Configure an Azure NAT Gateway for the subnet containing the VMs
- C
Implement an Azure Application Gateway with public-facing listeners
- D
Deploy an Azure Virtual Network Gateway using a site-to-site VPN connection
Show answer and explanation
Correct answer: B
Explanation
Azure NAT Gateway offers a managed, scalable, and cost-effective way to provide outbound-only internet access for resources in a subnet without exposing them to inbound traffic. This aligns with Microsoft’s best practices for securing Azure workloads. Refer to Microsoft's documentation on NAT Gateway (https://learn.microsoft.com/azure/virtual-network/nat-gateway/nat-overview) for more details on how to implement and manage it.
- A. Incorrect.
Option 1: Assigning a Public IP address to each VM is a valid way to enable internet connectivity. However, it increases operational overhead because you must manage multiple public IPs and handle security groups more granularly. This approach does not provide a central egress management solution, making it less optimal for the scenario.
- B. Correct.
Option 2: Configuring an Azure NAT Gateway for the subnet is the recommended solution for outbound-only internet connectivity. It allows all instances in the subnet to share a single or limited set of public IP addresses, simplifies management, and prevents inbound connections to the VMs by default. This meets the requirement of securing the hosts while still providing outbound internet access.
- C. Incorrect.
Option 3: Azure Application Gateway is primarily a Layer 7 load balancer designed for inbound HTTP/HTTPS traffic distribution and web application firewall capabilities. It does not address outbound-only connectivity for VMs. Therefore, it does not fit the scenario's main requirement of providing outbound access without inbound exposure.
- D. Incorrect.
Option 4: An Azure Virtual Network Gateway with a site-to-site VPN connection is used to securely connect an on-premises environment to Azure. It is not designed for simple outbound internet connectivity from Azure resources, making it unsuitable for the stated requirements.