AZ-700 Question 16
Single answerYou are designing an Azure solution for a multi-tier web application with six front-end nodes. The application requires a set of publicly routable IP addresses that are consistent over time to simplify external partner firewall whitelisting. You also want to minimize the administrative overhead of managing multiple individual public IPs. Based on this scenario, which approach should you implement to meet these requirements?
- A
Request a single public IP address and configure inbound NAT rules for each front-end node.
- B
Create six separate public IP addresses and attach them individually to each front-end node.
- C
Allocate a public IP address prefix and assign IPs from the prefix to the front-end nodes.
- D
Use an Azure NAT Gateway to dynamically assign ephemeral IP addresses for each front-end node.
Show answer and explanation
Correct answer: C
Explanation
Using a public IP address prefix allows you to request a contiguous range of IPs in Azure and assign them to resources such as VMs or load balancers. This approach ensures predictable and easily managed IP addresses for external whitelisting. According to Microsoft Docs (https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-address-prefix), public IP prefix reduces the administrative overhead of managing multiple discrete addresses while meeting consistency and scalability needs.
- A. Incorrect.
Option 1 is incorrect because a single public IP address does not meet the requirement for separate direct access to each front-end node. While inbound NAT rules can redirect traffic, this does not simplify firewall whitelisting with multiple endpoints and can introduce complexity.
- B. Incorrect.
Option 2 is incorrect because creating six individual public IP addresses can become cumbersome to manage. Although each node would have a dedicated public IP, this approach does not minimize administrative overhead and might make firewall whitelisting more tedious for partners.
- C. Correct.
Option 3 is correct. A public IP address prefix provides a contiguous block of IP addresses, reducing management overhead while still allowing each node to have its own public IP. It also simplifies external firewall rules by enabling partners to whitelist a single range rather than multiple discrete IP addresses.
- D. Incorrect.
Option 4 is incorrect because Azure NAT Gateway traditionally uses a pool of IP addresses for outbound traffic, not for hosting publicly accessible endpoints that need stable addresses across multiple front-end nodes. This would not fulfill the requirement for stable, directly routable IP addresses assigned at the node level.