AZ-700 Question 60
Single answerYou manage a private subnet running multiple Linux virtual machines (VMs) that require outbound Internet access only for OS updates and third-party API calls. You also need to ensure consistent, dedicated outbound IP addresses for auditing and security restrictions on the external APIs. Which solution should you implement to meet these outbound requirements while preventing any inbound connections from the Internet?
- A
Deploy a NAT gateway in the same subnet to manage outbound connections
- B
Create a public IP address for each VM� network interface and configure outbound rules
- C
Use Azure Application Gateway in front of the subnet for outbound traffic control
- D
Rely on the default outbound access IP addresses provided by Azure without any additional configuration
Show answer and explanation
Correct answer: A
Explanation
Azure NAT Gateway is the preferred solution when private subnets require controlled outbound Internet access with dedicated egress IP addresses, especially when no inbound connections are needed. It improves scalability and reliability by preventing ephemeral port exhaustion and ensures all VMs share consistent outbound IP addresses. Refer to Microsoft documentation on NAT Gateway (https://docs.microsoft.com/azure/virtual-network/nat-gateway) for detailed guidance.
- A. Correct.
Correct. A NAT gateway is specifically designed to handle outbound connectivity for private subnets. It ensures consistent, dedicated outbound IP addresses and does not allow inbound connections from the Internet.
- B. Incorrect.
Incorrect. Assigning a public IP address to each VM network interface would provide both inbound and outbound connectivity. This conflicts with the requirement to block inbound access and complicates management by having to maintain multiple public IPs.
- C. Incorrect.
Incorrect. Azure Application Gateway is primarily used for inbound HTTP/HTTPS traffic load balancing and web application firewall scenarios, not simply for outbound traffic from private subnets.
- D. Incorrect.
Incorrect. Default outbound access IP addresses are ephemeral and can change without notice, leading to potential issues with rate-limiting or API restrictions. This setup would not guarantee dedicated, consistent outbound IP addresses.