Microsoft Azure Administrator Associate AZ-104 Practice Question

An outbound rule in a network security group (NSG) blocking internet traffic is the most likely cause. NSGs control outbound as well as inbound traffic for Azure resources. If a custom outbound deny rule with a higher priority overrides the default AllowInternetOutBound rule, the VM loses internet connectivity while retaining access to resources inside the virtual network. Host-level firewalls could block traffic but would generally affect both internal and external destinations unless specifically scoped. A public IP address is not required for outbound access because Azure provides default outbound connectivity through source NAT unless it has been disabled. A gateway subnet is only required for VPN gateways, not for ordinary internet egress.