Azure NAT Gateway Minimum Subnets for VM1/VM2

AZ-700 By islever Editorial Last updated

Design and implement VNet connectivity and routing

Short answer

C Deploying the NAT Gateway requires a fourth dedicated subnet because it cannot be associated with Subnet1, Subnet2, or GatewaySubnet.

Question

You have an Azure subscription that contains the resources shown in the following table. You plan to deploy an Azure Virtual Network NAT gateway named Gateway1. The solution must meet the following requirements: • VM1 will access the internet by using its public IP address. • VM2 will access the internet by using its public IP address. • Administrative effort must be minimized. You need to ensure that you can deploy Gateway1 to Vnet1. What is the minimum number of subnets that Vnet1 must have? - Exhibit: Azure NAT Gateway Minimum Subnets for VM1/VM2
  1. 2
  2. 3
  3. 4 Correct Answer
  4. 5

Key Takeaways

Tests the constraint that Azure NAT Gateways require a dedicated subnet devoid of other resources, creating a trap where candidates forget that existing subnets (Subnet1, Subnet2, GatewaySubnet) are ineligible for association.

Determines the minimum subnet count required to deploy an Azure Virtual Network NAT gateway while preserving existing public IP configurations for VMs. Establishes that a dedicated subnet is mandatory because NAT Gateways cannot be associated with subnets containing basic resources or gateway subnets.

Common mistake: Choosing B (3) by assuming the NAT Gateway can share an existing subnet or does not require its own subnet at all, ignoring the requirement for a dedicated subnet for outbound traffic management.

Expert Analysis

Why the Answer Is Correct

The correct answer is C (4). To meet the requirements, you must retain VM1 and VM2 in their current subnets (Subnet1 and Subnet2) so they continue using their individual Public IPs. You also have an existing GatewaySubnet. The NAT Gateway itself is a regional resource but requires association with a specific subnet to manage egress traffic. Crucially, Azure documentation states that a NAT Gateway cannot be deployed in or associated with a subnet that contains basic resources (like VMs with Basic Public IPs) or a GatewaySubnet. Therefore, you need a fourth, dedicated subnet solely for the NAT Gateway association.

Why the Other Options Are Wrong

Option A (2) and Option D (5) are incorrect because they do not align with the minimum necessary infrastructure. Option B (3) is the most common distractor; it assumes that one of the existing three subnets can host the NAT Gateway. However, since Subnet1 and Subnet2 contain VMs, and GatewaySubnet is reserved for gateways, none can be used. Without a fourth subnet, there is no valid place to associate the NAT Gateway without violating the requirement to minimize administrative effort (i.e., moving VMs).

Community Comment Notes

As Jor466077 noted, "Cannot deploy in GatewaySugnet, and if deployed in Subnet1 or Subnet2 VM1 or VM2 will start accessing the Internet by using the NAT GW IP address," highlighting the conflict between existing configurations and NAT behavior. Gaz_ reinforced this by citing Microsoft docs: "NAT gateway can't be used with subnets where basic resources exist." Conversely, users like mohsim argued for B, mistakenly believing the NAT Gateway doesn't strictly require a new subnet, but this ignores the association constraints.

Official Reference

https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check if existing subnets are 'polluted' with resources that prevent NAT Gateway association. If VMs have Basic Public IPs or a subnet is a GatewaySubnet, you cannot associate a NAT Gateway there; you must provision a new, clean subnet.

Frequently Asked Questions

Why can't I associate the NAT Gateway with Subnet1?

You cannot associate a NAT Gateway with a subnet that contains resources using Basic Public IP addresses, as this would override their direct internet access.

Does the NAT Gateway itself consume a subnet?

Yes, while the NAT Gateway resource is regional, it must be associated with a specific subnet to handle outbound traffic for VMs within that subnet.

More AZ-700 FAQ →

Community Votes

C
63%
B
37%

63% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. Jor466077 👍 7 Answered C
    Cannot deploy in GatewaySugnet, and if deployed in Subnet1 or Subnet2 VM1 or VM2 will start accessing the Internet by using the NAT GW IP address. Thus, a new subnet (4th) is needed.
  2. mohsim 👍 3 Answered C
    Actually since we can't associate the NAT Gateway to any of the other three subnets, then a fourth subnet is required.
  3. mohsim 👍 3 Answered B
    NAT gateway doesn't require a subnet itself, only require a subne to be associated with. So the answer is 3
  4. GabiBT 👍 2 Answered B
    Yo solo veo que necesitemos 3 subredes no entiendo porque necesitaríamos una 4a Subnet1 y Subnet2 son necesarias para hospedar VM1 y VM2, respectivamente, cada una con su propia dirección IP pública. GatewaySubnet es necesaria para implementar la puerta de enlace NAT. Cual seria la 4 ???
  5. bobothewiseman 👍 2 Answered B
    • Since VM1 and VM2 will retain their public IPs, NAT Gateway will not manage their outbound traffic. • No additional subnets are required to deploy the NAT Gateway. • Therefore, VNet1 only needs 3 subnets: Subnet1, Subnet2, and the existing GatewaySubnet.
Show 2 more comments
  1. Gaz_ 👍 1 Answered C
    NAT gateway can't be used with subnets where basic resources exist. A NAT gateway can’t be deployed in a gateway subnet. https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview
  2. Diounaidou 👍 1 Answered C
    Cannont deploy Nat gatway in GatewaySubnet and in subnet where basic resource exists. therefore we need another subnet

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Private Endpoint UDR Routing Prerequisite

S-grade

Minimum Azure Service Endpoints for Peered VNets

S-grade

Logging Application of Specific NSG Rules

S-grade

Azure DNS Private Resolver Minimum Deployment

S-grade

Practice All AZ-700 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-700 Practice Test →

← Back to AZ-700 Study Guide