AZ-305 Question 227
Select 2Your company is hosting a multi-tier web application in Azure Virtual Machines within a single Virtual Network. The application must receive HTTP/HTTPS requests from the internet, which should be load balanced across multiple VMs in the web tier. Additionally, all VMs in this tier need to use a single, consistent public IP address for outbound internet connections, because your external provider only allows requests from that IP. You also want to strictly allow inbound traffic only on the necessary ports for HTTP/HTTPS. Which two solutions should you recommend to meet these requirements?
- A
A. Use a Basic Load Balancer for inbound traffic and assign a public IP to each VM for outbound connections.
- B
B. Deploy a Standard Load Balancer with a public IP for inbound traffic and attach an Azure NAT Gateway to the subnet for outbound traffic.
- C
C. Deploy a Standard Load Balancer with ephemeral outbound IP addresses, relying on Azure-provided addresses.
- D
D. Deploy an Azure Application Gateway for inbound HTTP/HTTPS traffic and attach an Azure NAT Gateway for outbound traffic.
Show answer and explanation
Correct answers: B, D
Explanation
To securely connect Azure VMs to the internet while meeting strict requirements, you can use a combination of load balancer (Standard Load Balancer or Application Gateway) for inbound traffic and Azure NAT Gateway for consistent outbound address translation. Basic load balancers and ephemeral outbound IPs do not guarantee a single, consistent IP. For more information, refer to Microsoft documentation on Azure NAT Gateway (https://learn.microsoft.com/azure/virtual-network/nat-gateway) and Azure load balancing options (https://learn.microsoft.com/azure/architecture/guide/technology-choices/load-balancing-overview).
- A. Incorrect.
A. Incorrect. While a Basic Load Balancer can distribute inbound traffic, assigning individual public IPs to each VM does not provide a single, consistent outbound IP address. It also complicates management and does not align well with best practices for securing traffic.
- B. Correct.
B. Correct. A Standard Load Balancer can handle inbound HTTP/HTTPS requests securely (when combined with NSGs or other security controls). Pairing it with an Azure NAT Gateway on the subnet provides a single, consistent outbound public IP address, meeting both connectivity and security requirements.
- C. Incorrect.
C. Incorrect. Standard Load Balancer with ephemeral outbound IPs uses Azure-provided addresses that can change, so it does not guarantee a single, consistent public IP for outbound traffic. This fails the requirement to have a known outbound IP for whitelisting with external providers.
- D. Correct.
D. Correct. Azure Application Gateway offers Layer 7 load balancing for inbound HTTP/HTTPS, and an Azure NAT Gateway can ensure a consistent outbound IP for all VMs in the subnet. This design meets both the inbound load balancing and outbound IP transparency requirements.