AZ-104 Implement and Manage Virtual Networking Practice Question
A backend subnet contains 18 Linux VMs that must install updates from the internet. Security requires all outbound traffic to use one static public IP, and none of the VMs may have their own public IP addresses. Which two changes meet the requirement? Select two.
⚠ Common exam trap
Many candidates confuse a public load balancer (inbound) with a NAT gateway (outbound), or assuming a route table alone can provide internet access without a NAT device or Azure Firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.
A NAT gateway provides outbound internet connectivity for VMs in a subnet while using a single static public IP address. By associating a NAT gateway with the backend subnet and assigning it a public IP, all outbound traffic from the 18 Linux VMs will source NAT to that static IP, meeting the security requirement without assigning public IPs to individual VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.
Why this is correct
A NAT gateway attached to the backend subnet translates outbound traffic from the Linux VMs to its configured public IP address or prefix. This gives all 18 VMs a stable, predictable source IP when contacting update repositories, and it scales automatically through SNAT without needing a public IP on each VM NIC or a separate egress appliance.
- ✓
Ensure the VMs do not have individual public IP addresses assigned.
Why this is correct
Per-VM public IP addresses would take precedence over the NAT gateway's egress path, because Azure gives a NIC's public IP priority for outbound traffic. Removing them ensures every VM's update traffic leaves through the NAT gateway's single public IP, centralizing the source address and simplifying firewall allowlists on the update servers.
- ✗
Create a public load balancer and add the VMs to its backend pool.
Why it's wrong here
A public load balancer is primarily an inbound traffic distribution mechanism that forwards connections to backend pool members; its backend pool does not, by itself, enable outbound internet access. Adding an outbound rule would require a separate frontend IP and configuration, making it more complex than the intended NAT gateway solution for a simple update scenario.
When this WOULD be correct
If the requirement were to distribute inbound internet traffic to the VMs (e.g., for a web application) while keeping them private, a public load balancer with backend pool members would be correct.
- ✗
Use a private endpoint for internet updates so outbound traffic remains private.
Why it's wrong here
Private endpoints are inbound-facing resources that assign a PaaS service, such as Azure Storage or SQL Database, a private IP inside your VNet. They do not provide any route to arbitrary internet destinations like Linux package repositories, so they cannot be used to make outbound internet updates private.
When this WOULD be correct
When the requirement is to securely access an Azure service (e.g., Storage, SQL Database) from a virtual network without using a public endpoint, ensuring traffic stays within the Microsoft backbone.
- ✗
Attach a route table with 0.0.0.0/0 to Virtual network gateway.
Why it's wrong here
A route table forcing a 0.0.0.0/0 next hop to a virtual network gateway steers internet-destined traffic into your hybrid network (VPN or ExpressRoute), not to Azure's internet edge. That path would require an on-premises forwarder and does not provide a public IP for egress, where a NAT gateway is the correct Azure-native control.
When this WOULD be correct
When the requirement is to force all outbound traffic from a subnet through a VPN or ExpressRoute gateway for inspection or tunneling to an on-premises network, and the VMs must not have direct internet access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.Correct answer▾
Why this is correct
A NAT gateway attached to the backend subnet translates outbound traffic from the Linux VMs to its configured public IP address or prefix. This gives all 18 VMs a stable, predictable source IP when contacting update repositories, and it scales automatically through SNAT without needing a public IP on each VM NIC or a separate egress appliance.
✗Create a public load balancer and add the VMs to its backend pool.Wrong answer — click to see why▾
Why this is wrong here
A public load balancer does not provide outbound connectivity for VMs without public IPs; it only distributes inbound traffic. The VMs would still lack a static public IP for outbound traffic.
★ When this WOULD be the correct answer
If the requirement were to distribute inbound internet traffic to the VMs (e.g., for a web application) while keeping them private, a public load balancer with backend pool members would be correct.
Why candidates choose this
Candidates may confuse load balancers with NAT devices, thinking a public load balancer can also handle outbound traffic, or they may overlook that load balancers are primarily for inbound traffic.
✗Use a private endpoint for internet updates so outbound traffic remains private.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint is used for inbound access to Azure services over a private IP, not for outbound traffic to the internet. It cannot provide outbound connectivity with a static public IP.
★ When this WOULD be the correct answer
When the requirement is to securely access an Azure service (e.g., Storage, SQL Database) from a virtual network without using a public endpoint, ensuring traffic stays within the Microsoft backbone.
Why candidates choose this
Candidates may confuse private endpoints with NAT or VPN solutions, thinking 'private' implies outbound privacy, but private endpoints are for inbound private connectivity only.
✗Attach a route table with 0.0.0.0/0 to Virtual network gateway.Wrong answer — click to see why▾
Why this is wrong here
A route table with 0.0.0.0/0 to a Virtual network gateway forces all outbound traffic through the gateway, but the gateway does not provide a single static public IP for outbound traffic; it typically uses the gateway's public IP, which may not be static and is not designed for outbound-only NAT.
★ When this WOULD be the correct answer
When the requirement is to force all outbound traffic from a subnet through a VPN or ExpressRoute gateway for inspection or tunneling to an on-premises network, and the VMs must not have direct internet access.
Why candidates choose this
Candidates may think that a route table with 0.0.0.0/0 to a gateway can centralize outbound traffic, similar to a NAT gateway, but they overlook that the gateway does not provide static outbound IP NAT and is intended for hybrid connectivity, not internet access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A subnet contains 15 backend VMs that only need outbound internet access for patching and package downloads. Security wants all outbound connections to use one static public IP address, and no VM should have a public IP assigned directly. What should you configure?
medium- A.A public Standard Load Balancer with outbound rules for the backend pool.
- ✓ B.A NAT gateway associated with the subnet.
- C.A public IP address on each virtual machine so all outbound traffic is traceable.
- D.An internal load balancer with a private frontend IP.
Why B: A NAT gateway is the recommended and purpose-built service for providing outbound internet access to VMs in a subnet without assigning public IPs directly. It performs SNAT and uses a single static public IP. While a Standard Load Balancer with outbound rules could technically also meet the requirements, NAT Gateway is the simpler, more cost-effective, and recommended solution for outbound-only scenarios.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.