separating name resolution from transport reachability narrows the source of failed access. In this case, a company wants its internal load balancer to serve only a private subnet's consumers. “Resolve the hostname, then test frontend and backend/probe connectivity separately” would not satisfy that requirement; the supported action is “Private frontend addressing together with NSG/routing restrictions”. A private frontend alone does not replace a complete least-privilege network access design.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, a company wants its internal load balancer to serve only a private subnet's consumers. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “Private frontend addressing together with NSG/routing restrictions”. A private frontend alone does not replace a complete least-privilege network access design.

health probes should reflect application service readiness, not only the VM's powered-on status. In this case, a company wants its internal load balancer to serve only a private subnet's consumers. “A failed application-specific health probe” would not satisfy that requirement; the supported action is “Private frontend addressing together with NSG/routing restrictions”. A private frontend alone does not replace a complete least-privilege network access design.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, a TCP load balancer stops routing traffic after a subnet route change. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “Effective routes on backend interfaces and health probe connectivity”. UDRs may affect return traffic and backend health, disrupting distributed connections.

separating name resolution from transport reachability narrows the source of failed access. In this case, a TCP load balancer stops routing traffic after a subnet route change. “Resolve the hostname, then test frontend and backend/probe connectivity separately” would not satisfy that requirement; the supported action is “Effective routes on backend interfaces and health probe connectivity”. UDRs may affect return traffic and backend health, disrupting distributed connections.

health probes should reflect application service readiness, not only the VM's powered-on status. In this case, a TCP load balancer stops routing traffic after a subnet route change. “A failed application-specific health probe” would not satisfy that requirement; the supported action is “Effective routes on backend interfaces and health probe connectivity”. UDRs may affect return traffic and backend health, disrupting distributed connections.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, an application uses multiple VM NICs but only one is in the backend pool. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “Backend membership is incomplete for the intended instances”. The load balancer distributes traffic among eligible configured backend endpoints, not every VM automatically.

health probes should reflect application service readiness, not only the VM's powered-on status. In this case, an application uses multiple VM NICs but only one is in the backend pool. “A failed application-specific health probe” would not satisfy that requirement; the supported action is “Backend membership is incomplete for the intended instances”. The load balancer distributes traffic among eligible configured backend endpoints, not every VM automatically.

correct DNS does not help when the load balancer has no eligible healthy backend targets. In this case, an application uses multiple VM NICs but only one is in the backend pool. “Repair health probes and backend application reachability rather than changing DNS” would not satisfy that requirement; the supported action is “Backend membership is incomplete for the intended instances”. The load balancer distributes traffic among eligible configured backend endpoints, not every VM automatically.

uDRs may affect return traffic and backend health, disrupting distributed connections. In this case, an engineer wants to distinguish DNS failure from a load balancer backend outage. “Effective routes on backend interfaces and health probe connectivity” would not satisfy that requirement; the supported action is “Resolve the hostname, then test frontend and backend/probe connectivity separately”. Separating name resolution from transport reachability narrows the source of failed access.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, an engineer wants to distinguish DNS failure from a load balancer backend outage. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “Resolve the hostname, then test frontend and backend/probe connectivity separately”. Separating name resolution from transport reachability narrows the source of failed access.

a private frontend alone does not replace a complete least-privilege network access design. In this case, an engineer wants to distinguish DNS failure from a load balancer backend outage. “Private frontend addressing together with NSG/routing restrictions” would not satisfy that requirement; the supported action is “Resolve the hostname, then test frontend and backend/probe connectivity separately”. Separating name resolution from transport reachability narrows the source of failed access.

load-balancer configuration does not bypass access rules at the backend interfaces. In this case, an app’s public hostname resolves correctly, but the load balancer reports all backends unhealthy. “The relevant effective NSG rules for the backend flow and probes” would not satisfy that requirement; the supported action is “Repair health probes and backend application reachability rather than changing DNS”. Correct DNS does not help when the load balancer has no eligible healthy backend targets.

health probes should reflect application service readiness, not only the VM's powered-on status. In this case, an app’s public hostname resolves correctly, but the load balancer reports all backends unhealthy. “A failed application-specific health probe” would not satisfy that requirement; the supported action is “Repair health probes and backend application reachability rather than changing DNS”. Correct DNS does not help when the load balancer has no eligible healthy backend targets.

separating name resolution from transport reachability narrows the source of failed access. In this case, an app’s public hostname resolves correctly, but the load balancer reports all backends unhealthy. “Resolve the hostname, then test frontend and backend/probe connectivity separately” would not satisfy that requirement; the supported action is “Repair health probes and backend application reachability rather than changing DNS”. Correct DNS does not help when the load balancer has no eligible healthy backend targets.

time-series visualization makes the failure trend visible instead of requiring isolated event inspection. In this case, an administrator needs near-real-time CPU percentage measurements for Azure VMs. “A chart of the storage-account metric or logged failures” would not satisfy that requirement; the supported action is “Platform metrics for the VM resource”. Metrics record time-series numerical measurements such as processor utilization for supported resources.

kQL is designed for filtering, correlating and summarizing telemetry in Log Analytics. In this case, an administrator needs near-real-time CPU percentage measurements for Azure VMs. “Kusto Query Language (KQL) in Logs” would not satisfy that requirement; the supported action is “Platform metrics for the VM resource”. Metrics record time-series numerical measurements such as processor utilization for supported resources.

logs support event-level queries that aggregate counters alone cannot reconstruct. In this case, an administrator needs near-real-time CPU percentage measurements for Azure VMs. “Diagnostic or application logs collected to a Log Analytics workspace” would not satisfy that requirement; the supported action is “Platform metrics for the VM resource”. Metrics record time-series numerical measurements such as processor utilization for supported resources.

diagnostic settings can stream Azure activity events to a supported destination for investigation. In this case, a team must investigate individual application requests across time, not just one aggregate count. “An activity log diagnostic setting with Log Analytics destination” would not satisfy that requirement; the supported action is “Diagnostic or application logs collected to a Log Analytics workspace”. Logs support event-level queries that aggregate counters alone cannot reconstruct.

resource log export is controlled by diagnostic settings and their selected categories and destinations. In this case, a team must investigate individual application requests across time, not just one aggregate count. “The storage diagnostic settings for the required resource-log categories” would not satisfy that requirement; the supported action is “Diagnostic or application logs collected to a Log Analytics workspace”. Logs support event-level queries that aggregate counters alone cannot reconstruct.

kQL grouping and time filters produce per-resource counts from collected events. In this case, a team must investigate individual application requests across time, not just one aggregate count. “A KQL aggregation over relevant records in Log Analytics” would not satisfy that requirement; the supported action is “Diagnostic or application logs collected to a Log Analytics workspace”. Logs support event-level queries that aggregate counters alone cannot reconstruct.

time-series visualization makes the failure trend visible instead of requiring isolated event inspection. In this case, an engineer needs to query several tables of collected Azure Monitor logs. “A chart of the storage-account metric or logged failures” would not satisfy that requirement; the supported action is “Kusto Query Language (KQL) in Logs”. KQL is designed for filtering, correlating and summarizing telemetry in Log Analytics.

metrics record time-series numerical measurements such as processor utilization for supported resources. In this case, an engineer needs to query several tables of collected Azure Monitor logs. “Platform metrics for the VM resource” would not satisfy that requirement; the supported action is “Kusto Query Language (KQL) in Logs”. KQL is designed for filtering, correlating and summarizing telemetry in Log Analytics.

kQL grouping and time filters produce per-resource counts from collected events. In this case, an engineer needs to query several tables of collected Azure Monitor logs. “A KQL aggregation over relevant records in Log Analytics” would not satisfy that requirement; the supported action is “Kusto Query Language (KQL) in Logs”. KQL is designed for filtering, correlating and summarizing telemetry in Log Analytics.

metrics record time-series numerical measurements such as processor utilization for supported resources. In this case, a monthly report needs a graph of storage transaction failures. “Platform metrics for the VM resource” would not satisfy that requirement; the supported action is “A chart of the storage-account metric or logged failures”. Time-series visualization makes the failure trend visible instead of requiring isolated event inspection.

resource log export is controlled by diagnostic settings and their selected categories and destinations. In this case, a monthly report needs a graph of storage transaction failures. “The storage diagnostic settings for the required resource-log categories” would not satisfy that requirement; the supported action is “A chart of the storage-account metric or logged failures”. Time-series visualization makes the failure trend visible instead of requiring isolated event inspection.

kQL is designed for filtering, correlating and summarizing telemetry in Log Analytics. In this case, a monthly report needs a graph of storage transaction failures. “Kusto Query Language (KQL) in Logs” would not satisfy that requirement; the supported action is “A chart of the storage-account metric or logged failures”. Time-series visualization makes the failure trend visible instead of requiring isolated event inspection.

the Activity Log records supported subscription-level management-plane operations. In this case, a VM performance dashboard shows gaps because the required guest counter was never collected. “Azure Activity Log administrative events for the subscription” would not satisfy that requirement; the supported action is “The appropriate guest monitoring collection, such as Azure Monitor Agent data collection rules”. Guest-level counters require an agent and collection configuration rather than assuming every metric is platform-provided.

diagnostic settings can stream Azure activity events to a supported destination for investigation. In this case, a VM performance dashboard shows gaps because the required guest counter was never collected. “An activity log diagnostic setting with Log Analytics destination” would not satisfy that requirement; the supported action is “The appropriate guest monitoring collection, such as Azure Monitor Agent data collection rules”. Guest-level counters require an agent and collection configuration rather than assuming every metric is platform-provided.

kQL is designed for filtering, correlating and summarizing telemetry in Log Analytics. In this case, a VM performance dashboard shows gaps because the required guest counter was never collected. “Kusto Query Language (KQL) in Logs” would not satisfy that requirement; the supported action is “The appropriate guest monitoring collection, such as Azure Monitor Agent data collection rules”. Guest-level counters require an agent and collection configuration rather than assuming every metric is platform-provided.

resource log export is controlled by diagnostic settings and their selected categories and destinations. In this case, an administrator wants to send activity log events to a shared analytics workspace. “The storage diagnostic settings for the required resource-log categories” would not satisfy that requirement; the supported action is “An activity log diagnostic setting with Log Analytics destination”. Diagnostic settings can stream Azure activity events to a supported destination for investigation.

logs support event-level queries that aggregate counters alone cannot reconstruct. In this case, an administrator wants to send activity log events to a shared analytics workspace. “Diagnostic or application logs collected to a Log Analytics workspace” would not satisfy that requirement; the supported action is “An activity log diagnostic setting with Log Analytics destination”. Diagnostic settings can stream Azure activity events to a supported destination for investigation.

the Activity Log records supported subscription-level management-plane operations. In this case, an administrator wants to send activity log events to a shared analytics workspace. “Azure Activity Log administrative events for the subscription” would not satisfy that requirement; the supported action is “An activity log diagnostic setting with Log Analytics destination”. Diagnostic settings can stream Azure activity events to a supported destination for investigation.