Courseiva

AZ-305 · topic practice

NAT Gateway practice questions

Practise AZ-305 NAT and PAT questions covering address translation types, inside/outside interface roles, static vs dynamic vs PAT, and troubleshooting missing or incorrect translations.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security
19 questionsDomain: NAT Gateway
Practice 10 questionsBrowse domain →

What the exam tests

What to know about NAT Gateway

NAT questions usually test how private addresses are translated, when to use static NAT, dynamic NAT or PAT, and how inside/outside interfaces affect traffic flow.

Static NAT, dynamic NAT and PAT behaviour.

Inside local, inside global, outside local and outside global address meanings.

How NAT affects connectivity between private networks and public destinations.

How to troubleshoot NAT rules, ACL matches and interface direction.

Why learners struggle

Why NAT Gateway questions are commonly missed

NAT questions are missed when learners confuse the four address types (inside local, inside global, outside local, outside global) or misapply the interface direction. A translation rule can look correct but still fail if the ACL, interface, or direction is wrong.

  • ·Inside local vs inside global — inside local is the private source, inside global is the translated public address
  • ·PAT overloads — many sources share one public IP using unique port numbers
  • ·Interface direction — ip nat inside and ip nat outside must be on the correct interfaces
  • ·Static NAT vs dynamic NAT vs PAT — each serves a different use case
  • ·The NAT ACL identifies traffic to translate, not traffic to permit or deny
  • ·A missing translation can look like a routing problem if the interfaces are misconfigured

Watch out for

Common NAT Gateway exam traps

  • ▸PAT allows many inside hosts to share one public address by using port numbers.
  • ▸NAT rules depend on correct inside and outside interface configuration.
  • ▸The ACL used for NAT identifies traffic to translate; it is not always a security filtering ACL.
  • ▸Static NAT maps one private address to one public address, while PAT overloads translations.

Practice set

NAT Gateway questions

19 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice
Read the full NAT/PAT explanation →

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Question 2mediummultiple choice
Read the full NAT/PAT explanation →

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Question 3easymultiple choice
Read the full NAT/PAT explanation →

A company has multiple virtual networks in different Azure regions. They need to connect all VNets together securely over the Microsoft backbone. They also need to connect to an on-premises data center via ExpressRoute. The solution should support transitive routing between all connected networks. Which Azure service should they use?

Question 4mediummultiple choice
Read the full NAT/PAT explanation →

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones. The application needs to automatically distribute incoming HTTPS traffic, offload SSL/TLS termination, and provide session persistence. Additionally, the solution must include a Web Application Firewall (WAF) to protect against common web vulnerabilities. Which Azure load balancing solution should they use?

Question 5easymultiple choice
Read the full NAT/PAT explanation →

A company plans to deploy a web application on Azure VMs across multiple availability zones. They need to distribute incoming HTTP traffic across the VMs and provide health probes. Which Azure load balancing solution should they use?

Question 6easymultiple choice
Read the full VPN explanation →

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

Question 7mediummultiple choice
Read the full NAT/PAT explanation →

A company deploys a containerized microservices application on Azure Kubernetes Service (AKS). They need to expose the application to the internet with TLS termination and provide a single endpoint for multiple services. The solution must also include a Web Application Firewall (WAF). Which Azure service should they use as the ingress controller?

Question 8mediummultiple choice
Read the full NAT/PAT explanation →

A company deploys a web application on multiple Azure VMs in a single region. They need to distribute incoming HTTP and HTTPS traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?

Question 9hardmultiple choice
Read the full NAT/PAT explanation →

A company is deploying a multi-tier web application on Azure. The web tier must be accessible from the internet. The application tier and database tier must be isolated within the virtual network and not directly accessible from the internet. The solution must provide SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities. Which Azure service should they use to expose the web tier?

Question 10mediummultiple choice
Read the full NAT/PAT explanation →

A company deploys a web application across multiple Azure VMs in a single region. They need to distribute incoming HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools (e.g., /images to one pool, /api to another). Which Azure load balancing solution should they use?

Question 11mediummultiple choice
Read the full NAT/PAT explanation →

A company plans to deploy a multi-tier application on Azure. The web tier requires SSL termination and health probes. The application tier must be isolated from the internet. The database tier requires high availability. They want to minimize administrative overhead and use Azure native services. Which architecture should they recommend?

Question 12easymultiple choice
Read the full NAT/PAT explanation →

A company is deploying a multi-tier web application on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must be isolated within the virtual network. The solution must provide SSL termination, web application firewall (WAF) capabilities, and URL-based routing. Which Azure service should they use to expose the web tier?

Question 13mediummulti select
Read the full NAT/PAT explanation →

Which TWO Azure services can be used to automatically redirect traffic to an alternate region in the event of a regional outage? (Choose two.)

Question 14hardmultiple choice
Read the full DNS explanation →

A multinational corporation needs to design a global DNS solution for Azure resources. They require automatic failover across Azure regions and low-latency responses based on the client's geographic location. The solution must also support custom domains without exposing the underlying Azure public IP addresses. Which combination of Azure services should they use?

Question 15hardmultiple choice
Read the full NAT/PAT explanation →

A company is planning to migrate a legacy application to Azure VMs. The application requires a static IP address for licensing purposes. The VM must be highly available within a single region. Which combination of Azure resources should they use?

Question 16easymultiple choice
Read the full NAT/PAT explanation →

You need to design a virtual network architecture for a three-tier application in Azure. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of Azure services should you use?

Question 17hardmultiple choice
Read the full NAT/PAT explanation →

You are designing a network architecture for a three-tier application hosted in Azure. The front-end tier must be accessible from the internet, the business tier must only communicate with the front-end tier, and the data tier must only communicate with the business tier. You need to minimize exposure and use Azure-native services. Which combination of services should you use?

Question 18easymultiple choice
Read the full NAT/PAT explanation →

A company is migrating on-premises applications to Azure. They require that all traffic between Azure resources and on-premises resources traverse a private connection. They also want to reduce the attack surface by eliminating exposure of management endpoints over the internet. Which solution should they implement?

Question 19mediummulti select
Read the full NAT/PAT explanation →

A company is designing a highly available architecture for a web application on Azure VMs. The solution must protect against both planned and unplanned downtime and provide automatic failover. Which TWO Azure services should the company use together? (Choose two.)

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused NAT Gateway sessions

Start a NAT Gateway only practice session

Every question in these sessions is drawn from the NAT Gateway domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all NAT Gateway questions →Mixed AZ-305 session

Related practice questions

Related AZ-305 topic practice pages

Move into related areas when this topic feels solid.

Design identity, governance, and monitoring solutions practice questions

Practise AZ-305 questions linked to Design identity, governance, and monitoring solutions.

Design data storage solutions practice questions

Practise AZ-305 questions linked to Design data storage solutions.

Design business continuity solutions practice questions

Practise AZ-305 questions linked to Design business continuity solutions.

Design infrastructure solutions practice questions

Practise AZ-305 questions linked to Design infrastructure solutions.

SAA-C03 VPC practice questions

Practise AZ-305 questions linked to SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise AZ-305 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

Practise AZ-305 questions linked to SAA-C03 RDS Multi-AZ questions.

SAA-C03 IAM policy practice questions

Practise AZ-305 questions linked to SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Practise AZ-305 questions linked to SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise AZ-305 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Practise AZ-305 questions linked to SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

Practise AZ-305 questions linked to SAA-C03 VPC endpoint questions.

Frequently asked questions

What does the AZ-305 exam test about NAT Gateway?
NAT questions usually test how private addresses are translated, when to use static NAT, dynamic NAT or PAT, and how inside/outside interfaces affect traffic flow.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just NAT Gateway questions in a focused session?
Yes — the session launcher on this page draws every question from the NAT Gateway domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other AZ-305 topics?
Use the topic links above to move to related areas, or go back to the AZ-305 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the AZ-305 exam covers. They are not copied from any real exam or dump site.