Get Your CertAZ-104PlayCompete
‹ All AZ-104 questions

AZ-104 Practice Question 78: NAT Gateway SNAT Exhaustion

Microsoft Azure Administrator Associate (AZ-104) · Test 8 · question 8 of 10

Virtual Networkingmedium

Two hundred virtual machines in one subnet make many short outbound HTTPS connections to a single external API. Connections fail intermittently, and diagnostics show SNAT port exhaustion for the default outbound access. The fix must not change the applications.

What should the administrator do?

Select one answer
Show answer and explanation

Answer:

  • B. Associate a NAT gateway that has a public IP address with the subnet

A NAT gateway provides outbound connectivity for a subnet with a large pool of SNAT ports from its public IP addresses, and the ports are allocated dynamically to the virtual machines. It solves exhaustion with no application change.

Option A adds compute but does not add SNAT ports.

Option C is not the issue: the traffic is not blocked, the ports run out.

Option D applies to traffic to Azure services over the backbone, not to a public third-party API.

Reference: What is Azure NAT Gateway?

Practice Test 8 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.
AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.
Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.
Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.
Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.