AZ-700 Question 62
Single answerYour company has deployed several Azure Virtual Machines across two subnets in a single virtual network. You need all outbound traffic from these VMs to use a single, consistent public IP address for auditing and security reasons. You also want to prevent any direct inbound requests from the public internet to the VMs. Which configuration should you implement to meet these requirements using an Azure NAT gateway?
- A
Attach a NAT gateway at the subnet level for both subnets, associate a single standard public IP with it, and ensure the VM NICs do not have public IP addresses assigned.
- B
Configure an Azure Load Balancer in front of the VMs and enable SNAT for the outbound traffic to guarantee a single public IP.
- C
Enable NAT within an Azure Firewall and attach a public IP to each VM NIC for outbound connectivity.
- D
Deploy a NAT gateway to the resource group only, relying on default outbound access for static public IP assignment.
Show answer and explanation
Correct answer: A
Explanation
To implement consistent outbound connectivity without exposing VMs directly to inbound traffic, you must associate the NAT gateway with the subnets containing the VMs and ensure these VMs do not have individual public IPs. This approach centralizes outbound traffic through the NAT gateway� public IP, as documented in the official Microsoft Azure NAT gateway best practices (https://learn.microsoft.com/azure/virtual-network/nat-gateway/nat-overview).
- A. Correct.
Correct. When you attach the NAT gateway to the subnets hosting the VMs and associate a single standard public IP, all outbound traffic uses that IP. Ensuring the VM NICs do not have public IP addresses assigned prevents direct inbound connections.
- B. Incorrect.
Incorrect. While an Azure Load Balancer can provide outbound SNAT, using it alone does not guarantee a single static public IP unless you configure additional resources and rules. NAT gateway is more straightforward for this scenario.
- C. Incorrect.
Incorrect. Azure Firewall can perform outbound NAT, but it requires more complex rules and configuration. Also, assigning public IPs to each VM NIC defeats the purpose of centralizing outbound traffic and blocking inbound traffic at the VM level.
- D. Incorrect.
Incorrect. Simply deploying a NAT gateway to the resource group without associating it to specific subnets will not route outbound traffic through that gateway. NAT gateways must be explicitly associated with one or more subnets.