Outbound connections from a subnet's VMs must use a static, predictable public IP that partners can allowlist — and scale beyond SNAT port limits of default outbound access. What provides this?
A.Public IP on each VM
Per-VM public IPs don't scale and increase attack surface.
B.NAT gateway associated to the subnet
NAT gateway = static egress IP + massive SNAT port pool. Correct.
C.An NSG outbound rule
NSGs filter traffic — they don't NAT anything.
D.Azure Firewall basic tier
Firewall could do it but is far heavier for pure egress NAT.
Why this answer
NAT gateway provides dedicated outbound SNAT with static public IPs, up to 16 addresses, and up to 64K ports per IP — far beyond default outbound access (which uses ephemeral IPs and is being phased out). It's the 'predictable outbound IP' answer.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Virtual Networking practice session.
Practice Virtual Networking