AZ-700 Question 59
Select 3You have an Azure Virtual Network containing multiple private subnets that host backend applications on virtual machines without public IP addresses. These applications must access external services on the Internet and need to maintain a consistent set of outbound IP addresses for whitelisting. Additionally, you want to optimize how outbound ports are allocated to reduce the risk of SNAT port exhaustion for high-volume traffic. Which of the following are appropriate use cases for implementing an Azure NAT gateway in this scenario?
- A
Provide stable, consistent outbound IP addresses for multiple VMs in a single subnet
- B
Establish inbound connectivity from the Internet to VMs without directly assigning public IP addresses
- C
Simplify the allocation of ephemeral outbound ports for high-volume or bursty traffic
- D
Expand the IP address capacity for outbound connections by distributing traffic across multiple public IP addresses
Show answer and explanation
Correct answers: A, C, D
Explanation
Azure NAT Gateway is designed to handle outbound traffic from subnets without requiring public IPs on individual resources. It ensures consistent and controllable egress IP addresses, minimizes SNAT port exhaustion, and can roll up several public IPs for large-scale scenarios. For more information, refer to Microsoft's documentation on Azure NAT Gateway: https://learn.microsoft.com/azure/virtual-network/nat-gateway/nat-overview.
- A. Correct.
Option 1 is correct. An Azure NAT gateway provides a consistent set of outbound IP addresses for VMs in private subnets, allowing you to whitelist specific egress IPs in external services.
- B. Incorrect.
Option 2 is incorrect. NAT gateways do not support inbound connections from the Internet; they only enable outbound connectivity for resources in private subnets.
- C. Correct.
Option 3 is correct. NAT gateways manage a large pool of available ephemeral ports, helping reduce the likelihood of SNAT port exhaustion in high-volume or bursty scenarios.
- D. Correct.
Option 4 is correct. By associating multiple public IP addresses, a NAT gateway can greatly expand the available source addresses used for outbound connections, which is beneficial for large-scale workloads.