AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides network address translation for outbound internet connectivity from private subnets without public IP addresses on individual resources?
⚠ Common exam trap
Test-takers frequently confuse Azure NAT Gateway with Azure Firewall or Load Balancer outbound rules, mistakenly thinking those services are designed for simple outbound NAT when they are actually focused on security filtering or load balancing, respectively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure NAT Gateway
Azure NAT Gateway is the correct service because it is specifically designed to provide outbound internet connectivity for resources in private subnets without requiring public IP addresses on individual VMs. It uses source network address translation (SNAT) to map private IPs to a single public IP or prefix, enabling outbound traffic while preventing inbound connections from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer with outbound rules
Why it's wrong here
Azure Load Balancer can be configured with outbound rules to perform SNAT for outbound internet traffic, but its primary purpose is inbound load balancing of traffic across backend pools. The outbound capability is limited and requires careful configuration of outbound rules and frontend IPs, and it is not as scalable or resilient for high-volume outbound traffic as Azure NAT Gateway. Additionally, Load Balancer's outbound SNAT is a secondary feature designed for specific scenarios, not a dedicated, fully managed NAT service. Therefore, while it technically works, Azure NAT Gateway is the purpose-built, scalable solution for this requirement.
- ✓
Azure NAT Gateway
Why this is correct
Azure NAT Gateway is a fully managed, highly resilient cloud-native service that provides outbound internet connectivity for virtual machines in private subnets within a virtual network. It performs source network address translation (SNAT) at scale, automatically handling port exhaustion by mapping multiple private IP addresses to a single public IP address or prefix. As a dedicated NAT service, it requires no manual configuration of rules or security policies, and it scales dynamically to meet outbound traffic demand. This makes it the correct and most appropriate solution for enabling outbound internet access from private resources in Azure.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed, stateful firewall-as-a-service that can perform SNAT for outbound connectivity, but it is primarily a security and filtering appliance with features like application rules, network rules, and threat intelligence. Its outbound connectivity is a side effect of its security rules, and it carries operational overhead involving rule management and security policy design. Azure NAT Gateway, by contrast, is a dedicated, stateless NAT service focused solely on providing simple, scalable outbound internet access without the complexity of firewall rules, making Azure Firewall not the ideal choice for this basic NAT requirement.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway is designed for encrypted cross-premises connectivity, such as site-to-site or point-to-site VPN tunnels between on-premises networks and Azure virtual networks. It routes traffic over IPSec tunnels and does not perform source network address translation (SNAT) for private resources needing outbound internet access. Instead, it ingresses and egresses traffic through the VPN tunnel, leaving internet-bound traffic unhandled. Hence, it is not the correct service for providing scalable outbound internet connectivity to private subnet resources.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.