Implement and Manage Virtual Networking →mediumMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Virtual Networking Practice Question

You removed public IP addresses from a backend subnet containing 20 VMs. The VMs still need outbound internet access for updates, and the organization wants all outbound traffic to appear from one predictable public IP. No inbound publishing is required. Which Azure service should you use?

⚠ Common exam trap

Watch out — candidates often confuse Azure NAT Gateway with a public load balancer for outbound traffic, mistakenly thinking inbound NAT rules are required for outbound connectivity, or assume a private load balancer can provide internet access via some indirect method.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure NAT Gateway associated with the subnet.

Azure NAT Gateway is the correct choice because it provides outbound-only internet connectivity for a subnet, translating all VM traffic to a single public IP address without requiring inbound NAT rules or a load balancer. It supports SNAT (Source Network Address Translation) for up to 64,000 concurrent flows per IP, meeting the requirement for predictable outbound IP and no inbound publishing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A public load balancer with inbound NAT rules for each VM.
Why it's wrong here
A public load balancer with inbound NAT rules maps individual VM ports to the load balancer's public frontend IP for inbound connections such as RDP or SSH. Those rules are specifically for publishing services to inbound internet clients, not for enabling VMs to initiate outbound requests. Although a public load balancer can support outbound with explicit outbound rules, the option's stated inbound NAT configuration does not provide the required outbound-only egress, and it ties each VM to a per-rule association rather than offering subnet-wide NAT.
When this WOULD be correct
This option would be correct if the question required inbound access to each VM from the internet, such as RDP or SSH, with distinct public IPs or ports for each VM, and outbound access was not the primary concern.
✓
Azure NAT Gateway associated with the subnet.
Why this is correct
Azure NAT Gateway is a fully managed, subnet-scoped NAT service that provides outbound-only internet connectivity. When attached to the subnet, it translates VM private IPs to its configured public IP(s) or public IP prefix, giving stable egress even after the VMs' own public IPs are removed. Because it scales to 64,000 concurrent connections per assigned IP and decouples outbound NAT from the VM's NIC, it is the designed solution for reliable outbound internet in this scenario.
✗
A private load balancer with a backend pool of the VMs.
Why it's wrong here
A private load balancer with a backend pool distributes internal virtual network traffic among the VMs on specified ports, but it has no public frontend and does not perform source network address translation to the internet. Its purpose is internal layer-4 load balancing, and it cannot provide a routable public IP or an egress path for the VMs. Therefore, removing the VMs' public IPs leaves the subnet with no outbound capability from this option.
When this WOULD be correct
When you need to distribute inbound traffic from internal clients to a set of backend VMs (e.g., a multi-tier application) without exposing them to the internet, and no outbound internet access is required.
✗
A VPN gateway connection to a remote network.
Why it's wrong here
A VPN gateway connects the Azure virtual network to an on-premises site over IPsec tunnels for private hybrid routing, but it is not an internet NAT device. It resides in a GatewaySubnet and forwards packets toward the remote network, while internet-destined traffic would still require a separate public egress path. Since the VPN gateway does not reverse-NAT VM private addresses to a public IP for internet, it fails to satisfy the outbound internet requirement.
When this WOULD be correct
An organization needs to securely connect an Azure virtual network to an on-premises datacenter over the internet, requiring site-to-site VPN connectivity.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Azure NAT Gateway associated with the subnet.Correct answer▾

Why this is correct

Azure NAT Gateway is a fully managed, subnet-scoped NAT service that provides outbound-only internet connectivity. When attached to the subnet, it translates VM private IPs to its configured public IP(s) or public IP prefix, giving stable egress even after the VMs' own public IPs are removed. Because it scales to 64,000 concurrent connections per assigned IP and decouples outbound NAT from the VM's NIC, it is the designed solution for reliable outbound internet in this scenario.

✗A public load balancer with inbound NAT rules for each VM.Wrong answer — click to see why▾

Why this is wrong here

A public load balancer with inbound NAT rules is designed for inbound traffic, not outbound. It does not provide a single predictable outbound public IP for all VMs in the subnet.

★ When this WOULD be the correct answer

This option would be correct if the question required inbound access to each VM from the internet, such as RDP or SSH, with distinct public IPs or ports for each VM, and outbound access was not the primary concern.

Why candidates choose this

Candidates may confuse load balancer capabilities, thinking that a public load balancer can handle outbound traffic similarly to NAT Gateway, or they may overlook the specific requirement for a single predictable outbound IP.

✗A private load balancer with a backend pool of the VMs.Wrong answer — click to see why▾

Why this is wrong here

A private load balancer only handles internal traffic within a virtual network and does not provide outbound internet connectivity. The VMs need outbound internet access, which a private load balancer cannot supply.

★ When this WOULD be the correct answer

When you need to distribute inbound traffic from internal clients to a set of backend VMs (e.g., a multi-tier application) without exposing them to the internet, and no outbound internet access is required.

Why candidates choose this

Candidates may confuse load balancer types, thinking a private load balancer can also provide outbound connectivity, or they may focus on the 'backend pool' concept without considering the direction of traffic.

✗A VPN gateway connection to a remote network.Wrong answer — click to see why▾

Why this is wrong here

A VPN gateway connects on-premises networks to Azure, not to the internet. It does not provide outbound internet access for Azure VMs.

★ When this WOULD be the correct answer

An organization needs to securely connect an Azure virtual network to an on-premises datacenter over the internet, requiring site-to-site VPN connectivity.

Why candidates choose this

Candidates may confuse VPN gateways with providing internet access, or think that routing traffic through a VPN to a remote network with internet access is a valid outbound path.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Visual reference

Go deeper

AZ-104 Implement and Manage Virtual Networking Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question