Question

You are designing outbound internet connectivity for workloads spread across three subnets in a zone-redundant Azure region. The security team requires all outbound SNAT to use a predictable set of static public IPs, and the architecture must survive the failure of a single availability zone. You plan to use Azure NAT Gateway. Which deployment approach correctly meets both the static-IP and zone-resilience requirements?

Accepted Answer

Deploy one zonal NAT Gateway per availability zone, associate each with subnets containing resources in that zone, and assign each its own static public IP or public IP prefix.

Answer

Deploy a single NAT Gateway configured as zone-redundant and associate it with all three subnets.

Answer

Deploy a single NAT Gateway and associate it with all three subnets, relying on Azure to automatically distribute it across all zones for resilience.

Answer

Associate the same zonal NAT Gateway with subnets in all three zones so the static IPs remain consistent across the region.