internal Load Balancer uses a private frontend to distribute supported network traffic to backends. In this case, a public TCP service needs a stable public listener with several VM backends. “An internal Azure Load Balancer” would not satisfy that requirement; the supported action is “A public Azure Load Balancer”. Public Load Balancer supplies a public frontend and layer-four distribution to backend instances.

an internal frontend exposes the service within permitted private networks rather than Internet ingress. In this case, a public TCP service needs a stable public listener with several VM backends. “A private frontend IP configuration on an internal load balancer” would not satisfy that requirement; the supported action is “A public Azure Load Balancer”. Public Load Balancer supplies a public frontend and layer-four distribution to backend instances.

load-balancing rules specify the transport and port mapping for eligible backend traffic. In this case, a public TCP service needs a stable public listener with several VM backends. “A load-balancing rule mapping the selected frontend and backend ports” would not satisfy that requirement; the supported action is “A public Azure Load Balancer”. Public Load Balancer supplies a public frontend and layer-four distribution to backend instances.

a failing health probe removes an instance from eligible backend flow distribution. In this case, a load balancer backend is healthy at the VM level but not receiving requests. “Configure the health probe to a reachable, appropriate service endpoint” would not satisfy that requirement; the supported action is “Load-balancer health probe state and load-balancing rule configuration”. Backends require passing probe results and correct rule mappings to receive eligible flows.

load-balancing rules specify the transport and port mapping for eligible backend traffic. In this case, a load balancer backend is healthy at the VM level but not receiving requests. “A load-balancing rule mapping the selected frontend and backend ports” would not satisfy that requirement; the supported action is “Load-balancer health probe state and load-balancing rule configuration”. Backends require passing probe results and correct rule mappings to receive eligible flows.

an internal frontend exposes the service within permitted private networks rather than Internet ingress. In this case, a load balancer backend is healthy at the VM level but not receiving requests. “A private frontend IP configuration on an internal load balancer” would not satisfy that requirement; the supported action is “Load-balancer health probe state and load-balancing rule configuration”. Backends require passing probe results and correct rule mappings to receive eligible flows.

backends require passing probe results and correct rule mappings to receive eligible flows. In this case, a TCP service listens on port 8443 but the load balancer probes port 80, which is closed. “Load-balancer health probe state and load-balancing rule configuration” would not satisfy that requirement; the supported action is “Configure the health probe to a reachable, appropriate service endpoint”. A failing health probe removes an instance from eligible backend flow distribution.

load-balancing rules specify the transport and port mapping for eligible backend traffic. In this case, a TCP service listens on port 8443 but the load balancer probes port 80, which is closed. “A load-balancing rule mapping the selected frontend and backend ports” would not satisfy that requirement; the supported action is “Configure the health probe to a reachable, appropriate service endpoint”. A failing health probe removes an instance from eligible backend flow distribution.

unhealthy backends are excluded, so repairing probe reachability precedes balancing adjustments. In this case, a TCP service listens on port 8443 but the load balancer probes port 80, which is closed. “The backend instances' probe response and relevant NSG path” would not satisfy that requirement; the supported action is “Configure the health probe to a reachable, appropriate service endpoint”. A failing health probe removes an instance from eligible backend flow distribution.

backends require passing probe results and correct rule mappings to receive eligible flows. In this case, an administrator needs different frontend and backend TCP ports for a load-balanced service. “Load-balancer health probe state and load-balancing rule configuration” would not satisfy that requirement; the supported action is “A load-balancing rule mapping the selected frontend and backend ports”. Load-balancing rules specify the transport and port mapping for eligible backend traffic.

public Load Balancer supplies a public frontend and layer-four distribution to backend instances. In this case, an administrator needs different frontend and backend TCP ports for a load-balanced service. “A public Azure Load Balancer” would not satisfy that requirement; the supported action is “A load-balancing rule mapping the selected frontend and backend ports”. Load-balancing rules specify the transport and port mapping for eligible backend traffic.

a failing health probe removes an instance from eligible backend flow distribution. In this case, an administrator needs different frontend and backend TCP ports for a load-balanced service. “Configure the health probe to a reachable, appropriate service endpoint” would not satisfy that requirement; the supported action is “A load-balancing rule mapping the selected frontend and backend ports”. Load-balancing rules specify the transport and port mapping for eligible backend traffic.

internal Load Balancer uses a private frontend to distribute supported network traffic to backends. In this case, an internal application must not use a public IP at the frontend. “An internal Azure Load Balancer” would not satisfy that requirement; the supported action is “A private frontend IP configuration on an internal load balancer”. An internal frontend exposes the service within permitted private networks rather than Internet ingress.

backends require passing probe results and correct rule mappings to receive eligible flows. In this case, an internal application must not use a public IP at the frontend. “Load-balancer health probe state and load-balancing rule configuration” would not satisfy that requirement; the supported action is “A private frontend IP configuration on an internal load balancer”. An internal frontend exposes the service within permitted private networks rather than Internet ingress.

load-balancing rules specify the transport and port mapping for eligible backend traffic. In this case, an internal application must not use a public IP at the frontend. “A load-balancing rule mapping the selected frontend and backend ports” would not satisfy that requirement; the supported action is “A private frontend IP configuration on an internal load balancer”. An internal frontend exposes the service within permitted private networks rather than Internet ingress.

load-balancing rules specify the transport and port mapping for eligible backend traffic. In this case, a VM scale set must receive load-balanced requests as new instances join. “A load-balancing rule mapping the selected frontend and backend ports” would not satisfy that requirement; the supported action is “Membership of the scale-set instances in the appropriate backend pool”. Load balancer backend pools govern which instances can receive distributed flows.

unhealthy backends are excluded, so repairing probe reachability precedes balancing adjustments. In this case, a VM scale set must receive load-balanced requests as new instances join. “The backend instances' probe response and relevant NSG path” would not satisfy that requirement; the supported action is “Membership of the scale-set instances in the appropriate backend pool”. Load balancer backend pools govern which instances can receive distributed flows.

backends require passing probe results and correct rule mappings to receive eligible flows. In this case, a VM scale set must receive load-balanced requests as new instances join. “Load-balancer health probe state and load-balancing rule configuration” would not satisfy that requirement; the supported action is “Membership of the scale-set instances in the appropriate backend pool”. Load balancer backend pools govern which instances can receive distributed flows.

backends require passing probe results and correct rule mappings to receive eligible flows. In this case, a public load balancer sends traffic to only one instance due to probe failures. “Load-balancer health probe state and load-balancing rule configuration” would not satisfy that requirement; the supported action is “The backend instances' probe response and relevant NSG path”. Unhealthy backends are excluded, so repairing probe reachability precedes balancing adjustments.

load balancer backend pools govern which instances can receive distributed flows. In this case, a public load balancer sends traffic to only one instance due to probe failures. “Membership of the scale-set instances in the appropriate backend pool” would not satisfy that requirement; the supported action is “The backend instances' probe response and relevant NSG path”. Unhealthy backends are excluded, so repairing probe reachability precedes balancing adjustments.

a failing health probe removes an instance from eligible backend flow distribution. In this case, a public load balancer sends traffic to only one instance due to probe failures. “Configure the health probe to a reachable, appropriate service endpoint” would not satisfy that requirement; the supported action is “The backend instances' probe response and relevant NSG path”. Unhealthy backends are excluded, so repairing probe reachability precedes balancing adjustments.

uDRs may affect return traffic and backend health, disrupting distributed connections. In this case, a team wants to distribute HTTP traffic using host/path routing and TLS termination at a gateway. “Effective routes on backend interfaces and health probe connectivity” would not satisfy that requirement; the supported action is “Azure Application Gateway rather than a layer-four Load Balancer”. Application Gateway supports application-aware HTTP routing, unlike basic TCP/UDP distribution.

health probes should reflect application service readiness, not only the VM's powered-on status. In this case, a team wants to distribute HTTP traffic using host/path routing and TLS termination at a gateway. “A failed application-specific health probe” would not satisfy that requirement; the supported action is “Azure Application Gateway rather than a layer-four Load Balancer”. Application Gateway supports application-aware HTTP routing, unlike basic TCP/UDP distribution.

correct DNS does not help when the load balancer has no eligible healthy backend targets. In this case, a team wants to distribute HTTP traffic using host/path routing and TLS termination at a gateway. “Repair health probes and backend application reachability rather than changing DNS” would not satisfy that requirement; the supported action is “Azure Application Gateway rather than a layer-four Load Balancer”. Application Gateway supports application-aware HTTP routing, unlike basic TCP/UDP distribution.

correct DNS does not help when the load balancer has no eligible healthy backend targets. In this case, a backend VM is powered on but its application process has crashed. “Repair health probes and backend application reachability rather than changing DNS” would not satisfy that requirement; the supported action is “A failed application-specific health probe”. Health probes should reflect application service readiness, not only the VM's powered-on status.

uDRs may affect return traffic and backend health, disrupting distributed connections. In this case, a backend VM is powered on but its application process has crashed. “Effective routes on backend interfaces and health probe connectivity” would not satisfy that requirement; the supported action is “A failed application-specific health probe”. Health probes should reflect application service readiness, not only the VM's powered-on status.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, a backend VM is powered on but its application process has crashed. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “A failed application-specific health probe”. Health probes should reflect application service readiness, not only the VM's powered-on status.

correct DNS does not help when the load balancer has no eligible healthy backend targets. In this case, a load-balancer rule exists but the VM NSG drops backend traffic. “Repair health probes and backend application reachability rather than changing DNS” would not satisfy that requirement; the supported action is “The relevant effective NSG rules for the backend flow and probes”. Load-balancer configuration does not bypass access rules at the backend interfaces.

uDRs may affect return traffic and backend health, disrupting distributed connections. In this case, a load-balancer rule exists but the VM NSG drops backend traffic. “Effective routes on backend interfaces and health probe connectivity” would not satisfy that requirement; the supported action is “The relevant effective NSG rules for the backend flow and probes”. Load-balancer configuration does not bypass access rules at the backend interfaces.

the load balancer distributes traffic among eligible configured backend endpoints, not every VM automatically. In this case, a load-balancer rule exists but the VM NSG drops backend traffic. “Backend membership is incomplete for the intended instances” would not satisfy that requirement; the supported action is “The relevant effective NSG rules for the backend flow and probes”. Load-balancer configuration does not bypass access rules at the backend interfaces.

separating name resolution from transport reachability narrows the source of failed access. In this case, a company wants its internal load balancer to serve only a private subnet's consumers. “Resolve the hostname, then test frontend and backend/probe connectivity separately” would not satisfy that requirement; the supported action is “Private frontend addressing together with NSG/routing restrictions”. A private frontend alone does not replace a complete least-privilege network access design.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, a company wants its internal load balancer to serve only a private subnet's consumers. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “Private frontend addressing together with NSG/routing restrictions”. A private frontend alone does not replace a complete least-privilege network access design.

health probes should reflect application service readiness, not only the VM's powered-on status. In this case, a company wants its internal load balancer to serve only a private subnet's consumers. “A failed application-specific health probe” would not satisfy that requirement; the supported action is “Private frontend addressing together with NSG/routing restrictions”. A private frontend alone does not replace a complete least-privilege network access design.