AZ-700 Question 186
Single answerYou have a web application running on a set of virtual machines (VMs) behind an Azure Standard Load Balancer. Currently, your outbound connections rely on the default SNAT configurations managed by the load balancer. You are seeing occasional connectivity issues related to ephemeral port exhaustion and want to ensure outbound traffic for these VMs uses a consistent public IP address range. You decide to configure an explicit outbound rule to address this. Which action should you take to meet this requirement?
- A
Create an outbound rule on the Standard Load Balancer that references multiple frontend public IP addresses and assigns a custom outbound port range to the VM backend pool.
- B
Associate a public IP on each individual VM network interface so that outbound connections originate from each VM's dedicated address.
- C
Enable TCP Reset on idle connections for an inbound NAT rule on the Standard Load Balancer to reuse ephemeral ports more efficiently.
- D
Use Azure Firewall to define DNAT rules that map internal traffic to individual public IP addresses configured on the virtual network.
Show answer and explanation
Correct answer: A
Explanation
When using a Standard Load Balancer by default, Azure manages ephemeral ports and can assign outbound connections to implicit SNAT pools. This setup can lead to port exhaustion in high-traffic scenarios. Configuring an explicit outbound rule on the Standard Load Balancer allows you to specify one or more public IP addresses, a custom port range, and a backend pool, thereby ensuring that outbound traffic from the VMs uses a consistent public address range. This reduces the chance of ephemeral port exhaustion. Refer to Microsoft's documentation on Standard Load Balancer outbound rules to learn about recommended configurations and best practices (https://learn.microsoft.com/azure/load-balancer/load-balancer-outbound-rules).
- A. Correct.
Correct. Creating an outbound rule on the Standard Load Balancer with one or more frontend public IP addresses and a customized outbound port range helps alleviate port exhaustion and ensures outbound connections from the VM backend pool have consistent egress IP addresses.
- B. Incorrect.
Incorrect. Assigning a separate public IP to every VM might provide consistent IPs, but it does not scale well for larger deployments and does not address ephemeral port exhaustion as efficiently as an explicit outbound rule or NAT gateway configuration.
- C. Incorrect.
Incorrect. Enabling TCP Reset for inbound NAT rules does not directly address outbound SNAT behavior or ephemeral port exhaustion for outbound traffic. TCP Reset on idle is related to cleaning up idle inbound connections, not improving outbound egress availability.
- D. Incorrect.
Incorrect. Azure Firewall DNAT rules primarily handle inbound traffic mapping. For controlling outbound traffic and ensuring consistent egress IP addresses, an outbound rule on the load balancer or a NAT gateway is required.