What resource is required to receive inbound traffic from the internet to VM-Series NGFW deployed as a gateway for Azure Stack workloads?

Question

Options

• APublic IP for the VM-Series NGFW
• BNAT appliance
• CAzure Stack Edge Router
• DBorder Customer Network

• A
  4% (2)
• B
  88% (42)
• C
  2% (1)
• D
  6% (3)

Explanation

Option B is correct because Azure Stack Hub does not natively assign routable public IP addresses directly to VM instances the way Azure public cloud does - a NAT appliance sits in front of the VM-Series NGFW and translates inbound internet traffic to the firewall's private IP address, enabling it to function as the gateway for Azure Stack workloads.

Why the distractors are wrong:

• A (Public IP for VM-Series NGFW): In standard Azure, a public IP would suffice, but Azure Stack Hub's on-premises networking model doesn't directly expose public IPs to VM interfaces the same way - NAT is the required mechanism.
• C (Azure Stack Edge Router): This is part of the underlying Azure Stack infrastructure, but it's not a resource you provision or configure to receive inbound traffic to your NGFW.
• D (Border Customer Network): This refers to the customer's upstream network boundary, not a deployable Azure Stack resource that enables inbound traffic flow to a specific VM.

Memory tip: Think "Azure Stack = on-prem constraints." On-premises environments almost always require NAT to bridge public internet traffic to private internal addresses - Azure Stack follows this same pattern, unlike native Azure where public IPs attach directly to NICs or load balancers.

No community discussion yet for this question.