AZ-700 Question 185
Single answerYou manage an Azure Load Balancer configured with a back-end pool of virtual machines in a private subnet. Your team wants to ensure that all outbound traffic from these VMs is NATed through the Load Balancer using a specific public IP address. You decide to create an explicit outbound rule to configure Source Network Address Translation (SNAT). Which of the following approaches correctly achieves this goal?
- A
Create an outbound rule on the Load Balancer, specifying the front-end public IP for the Source NAT and associating the back-end pool VMs with that rule.
- B
Add a new inbound NAT rule on the Load Balancer, selecting the public IP as the front end and assigning the target port range for each back-end VM.
- C
Configure multiple front-end public IP addresses on the Load Balancer and rely on the default Azure SNAT behavior without creating an outbound rule.
- D
Place the VMs behind an Application Gateway and enable outbound connections to automatically use a managed public IP, removing the need for an outbound rule.
Show answer and explanation
Correct answer: A
Explanation
To ensure that all outbound traffic from back-end pool VMs uses a single public IP address, you must create an outbound rule on the Azure Load Balancer that explicitly references the front-end public IP address and associates it with the back-end pool. According to Microsoft documentation, outbound rules specify how the Load Balancer translates outbound flows (source NAT) from private addresses to the front-end public IP address. This approach provides predictable egress behavior and is the recommended configuration when a single public IP address is required for all outbound flows.
- A. Correct.
Option 1 is correct. An outbound rule explicitly associates the specified front-end public IP address with the back-end pool for outbound flows, ensuring that all traffic originating from these VMs uses the chosen public IP. This is the proper method when you need fine-grained control over SNAT.
- B. Incorrect.
Option 2 is incorrect because inbound NAT rules do not control how outbound traffic is egressed. Inbound NAT rules forward traffic to a specific VM� port but do not define the public IP used by VMs when sending outbound requests.
- C. Incorrect.
Option 3 is incorrect because relying on the default Azure SNAT behavior does not guarantee a single fixed public IP unless a specific outbound rule is defined. By default, Azure can use ephemeral IPs for outbound traffic if no rule is in place.
- D. Incorrect.
Option 4 is incorrect because using an Application Gateway for outbound traffic is not required in this scenario and does not replace the need for an explicit outbound rule on the Load Balancer when you need consistent egress through a single public IP.