AZ-700 Question 61
Single answerYou manage an Azure virtual network (VNet) that hosts multiple application servers in a private subnet. These servers must access external services over the internet without exposing their individual public IP addresses. You decide to implement a NAT Gateway to share a single or limited set of public IPs for outbound flows and to ensure sufficient ephemeral ports. Which configuration approach should you take to achieve this?
- A
Create a NAT Gateway and associate it with each virtual machine� network interface for outbound traffic.
- B
Create a NAT Gateway resource, associate it with the subnet, and attach a public IP address or public IP prefix to the NAT Gateway.
- C
Assign a public IP address to each virtual machine, and then enable the NAT Gateway at the virtual network level.
- D
Use an Azure Load Balancer with an outbound rule to forward outbound traffic from the subnet to an existing public IP address.
Show answer and explanation
Correct answer: B
Explanation
When implementing a NAT Gateway in Azure, you must create the NAT Gateway resource and associate it at the subnet level. You then attach one or more public IP resources (either a Public IP address or a Public IP prefix) to the NAT Gateway to ensure all outbound traffic from that subnet is masked behind a consistent set of public IP addresses. This approach is the recommended way to scale outbound connectivity and manage ephemeral ports efficiently (refer to Microsoft Docs: https://learn.microsoft.com/azure/virtual-network/nat-gateway/nat-overview).
- A. Incorrect.
Incorrect. NAT Gateways in Azure are associated at the subnet level, not with individual network interfaces. Attaching it directly to each VM� NIC is not supported, so this option is not feasible.
- B. Correct.
Correct. A NAT Gateway is deployed as a resource and should be associated with the subnet that needs outbound connectivity. You must also attach one or more public IP addresses or a public IP prefix to the NAT Gateway so that all outbound traffic uses those addresses.
- C. Incorrect.
Incorrect. Giving each VM its own public IP address defeats the purpose of using a NAT Gateway to consolidate outbound traffic. Additionally, there is no way to 'enable' a NAT Gateway at the entire virtual network level; it is specifically associated with subnets.
- D. Incorrect.
Incorrect. While Azure Load Balancer outbound rules can provide outbound access, they are more commonly used for load balancing scenarios rather than NAT consolidation. A NAT Gateway resource is the recommended feature for large-scale outbound NAT requirements.