A team deploys VMs into a new subnet in a recently created VNet. The VMs must download patches from public repositories using a stable outbound IP, and nothing on the internet should be able to initiate connections to them. What is the best fit?
Show answer and explanation
Answer: B
Subnets in VNets created with recent API versions are private by default, so they have no implicit internet egress. A NAT gateway associated with the subnet gives all outbound flows a predictable public IP address and does not accept unsolicited inbound connections. That combination matches the patching requirement exactly.
Why the other options are wrong
- A. A public IP on each VM makes that VM reachable from the internet, which violates the no-inbound requirement. Basic SKU public IPs have also been retired.
- C. A Standard Load Balancer can provide outbound rules, but inbound rules expose the VMs to incoming traffic, and the design is heavier than the requirement needs.
- D. Bastion is for administrator sessions into VMs. It does not provide outbound internet access for package downloads.