Topic 13 Practice Test 1 covers Azure DNS and Load Balancing for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure name resolution and load balancing. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
A cloud engineer at Trey Research is working with a design that is moving contoso.com public DNS hosting to Azure but internet resolvers still query the former DNS provider. What is required? Choose ONE.
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Use an Azure Private DNS zone and link the required virtual network
- Create or update an A record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: A
Correct Answer
Answer A is correct because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The key requirement is to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That is the best fit here.
Incorrect Answers
Answer B is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. Here the administrator must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This misses the scenario’s key constraint.
Answer C is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The deciding need is to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That does not meet the deciding constraint.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. Operationally, the team must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This solves a different Azure problem.
Question 2
During an operational review at Woodgrove Bank, the team finds that the environment copied public records into Azure DNS but external clients cannot discover the Azure-hosted zone because delegation was never changed. What should the administrator use? Choose ONE.
- Use an Azure Private DNS zone and link the required virtual network
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Create or update an A record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: B
Correct Answer
Answer B is correct because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The requirement is to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The scenario requires the team to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That behavior differs from the requirement.
Answer C is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. Operationally, the team must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This would not produce the requested result.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. For this design, the team must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That feature addresses another administration need.
Question 3
At Fourth Coffee, the team has two active IPv4 addresses for www and wants both values in the same DNS name-and-type collection. Which option best meets the requirement? Choose ONE.
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Create or update an A record set
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: C
Correct Answer
Answer C is correct because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The scenario requires the team to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That directly meets the stated constraint.
Incorrect Answers
Answer A is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The requested outcome is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This solves a different Azure problem.
Answer B is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. For this design, the team must map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That leaves the required outcome unmet.
Answer D is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. Here the administrator must map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This is adjacent, but not sufficient.
Question 4
During an operational review at Tailspin Toys, the team finds that the environment must publish api.contoso.com for an application whose stable frontend IPv4 address is 203.0.113.20. What should the administrator use? Choose ONE.
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Use an Azure Private DNS zone and link the required virtual network
- Create or update an A record set
Correct Answer: D
Correct Answer
Answer D is correct because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requested outcome is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This directly implements the requested outcome.
Incorrect Answers
Answer A is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The key requirement is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That feature addresses another administration need.
Answer B is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. Here the administrator must map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This misses the scenario’s key constraint.
Answer C is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The deciding need is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That does not meet the deciding constraint.
Question 5
At A. Datum, the team needs portal.contoso.com to follow the service hostname app.azurewebsites.net without storing that service IP in DNS. Which option best meets the requirement? Choose ONE.
- Create a CNAME record for the subdomain
- Create or update an A record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Change the TTL on the Azure DNS record set
Correct Answer: A
Correct Answer
Answer A is correct because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The key requirement is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That matches the requested operational result.
Incorrect Answers
Answer B is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requirement is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This is adjacent, but not sufficient.
Answer C is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The scenario requires the team to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That behavior differs from the requirement.
Answer D is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. Operationally, the team must map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This would not produce the requested result.
Question 6
An Azure administrator for Trey Research learns that the environment must replace an A record on a non-apex name with a host-name alias so endpoint address changes remain the provider responsibility. What should be done? Choose ONE.
- Create or update an A record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Change the TTL on the Azure DNS record set
Correct Answer: B
Correct Answer
Answer B is correct because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. For this design, the team must map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This meets the deciding technical requirement.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The scenario requires the team to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That does not meet the deciding constraint.
Answer C is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The requested outcome is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This solves a different Azure problem.
Answer D is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. For this design, the team must map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That leaves the required outcome unmet.
Question 7
A cloud engineer at Tailspin Toys is working with a design that is eliminating a manually maintained apex A-record address and wants the DNS record to reference the Azure public IP resource directly. What is required? Choose ONE.
- Create or update an A record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Change the TTL on the Azure DNS record set
Correct Answer: C
Correct Answer
Answer C is correct because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. Here the administrator must use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That satisfies the scenario without extra changes.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requested outcome is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This would not produce the requested result.
Answer B is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The key requirement is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That feature addresses another administration need.
Answer D is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. Here the administrator must use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This misses the scenario’s key constraint.
Question 8
An Azure administrator for Humongous Insurance learns that the environment publishes contoso.com at the zone apex and wants DNS to follow an Azure public IP resource if the assigned IP changes. What should be done? Choose ONE.
- Create or update an A record set
- Create a CNAME record for the subdomain
- Change the TTL on the Azure DNS record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: D
Correct Answer
Answer D is correct because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The deciding need is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This produces the required Azure behavior.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The key requirement is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That leaves the required outcome unmet.
Answer B is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The requirement is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This is adjacent, but not sufficient.
Answer C is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. The scenario requires the team to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That behavior differs from the requirement.
Question 9
A cloud engineer at Adventure Works is working with a design that will change a service address tomorrow and wants recursive resolvers to retain the old DNS answer for less time during the migration. What is required? Choose ONE.
- Change the TTL on the Azure DNS record set
- Create or update an A record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: A
Correct Answer
Answer A is correct because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. Operationally, the team must reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That is the best fit here.
Incorrect Answers
Answer B is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. For this design, the team must reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This misses the scenario’s key constraint.
Answer C is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The scenario requires the team to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That does not meet the deciding constraint.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The requested outcome is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This solves a different Azure problem.
Question 10
During an operational review at A. Datum, the team finds that the environment needs clients to re-query authoritative DNS sooner after an upcoming record update without changing the record type itself. What should the administrator use? Choose ONE.
- Create or update an A record set
- Change the TTL on the Azure DNS record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: B
Correct Answer
Answer B is correct because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. For this design, the team must reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. Here the administrator must reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That behavior differs from the requirement.
Answer C is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The requested outcome is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This would not produce the requested result.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The key requirement is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That feature addresses another administration need.
Question 11
At Humongous Insurance, the team is replacing custom DNS-server records for a private Azure namespace and wants Azure-managed private zone resolution. Which option best meets the requirement? Choose ONE.
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Create a CNAME record for the subdomain
- Use an Azure Private DNS zone and link the required virtual network
- Create or update an A record set
Correct Answer: C
Correct Answer
Answer C is correct because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. Here the administrator must provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That directly meets the stated constraint.
Incorrect Answers
Answer A is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The deciding need is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This solves a different Azure problem.
Answer B is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The key requirement is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That leaves the required outcome unmet.
Answer D is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requirement is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This is adjacent, but not sufficient.
Question 12
During an operational review at Wingtip Toys, the team finds that the environment has database names that should resolve only from application VNets and must not appear in public DNS. What should the administrator use? Choose ONE.
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Create a CNAME record for the subdomain
- Create or update an A record set
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: D
Correct Answer
Answer D is correct because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The deciding need is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This directly implements the requested outcome.
Incorrect Answers
Answer A is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. Operationally, the team must provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That feature addresses another administration need.
Answer B is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. For this design, the team must provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This misses the scenario’s key constraint.
Answer C is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The scenario requires the team to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That does not meet the deciding constraint.
Question 13
At City Power & Light, the team hosts two web proxy VMs and needs one public frontend IP that distributes incoming TCP connections between them. Which option best meets the requirement? Choose ONE.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: A
Correct Answer
Answer A is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The requested outcome is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That matches the requested operational result.
Incorrect Answers
Answer B is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. For this design, the team must distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This is adjacent, but not sufficient.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. Here the administrator must distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That behavior differs from the requirement.
Answer D is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The requested outcome is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This would not produce the requested result.
Question 14
An Azure administrator for Adventure Works learns that the environment requires an internet-routable frontend while keeping multiple backend VMs in one pool for scale and availability. What should be done? Choose ONE.
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: B
Correct Answer
Answer B is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The key requirement is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This meets the deciding technical requirement.
Incorrect Answers
Answer A is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. Here the administrator must distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That does not meet the deciding constraint.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The deciding need is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This solves a different Azure problem.
Answer D is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The key requirement is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That leaves the required outcome unmet.
Question 15
A cloud engineer at Wingtip Toys is working with a design that is removing an unnecessary public frontend because all clients are private and reach the service through Azure networking. What is required? Choose ONE.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
Correct Answer: C
Correct Answer
Answer C is correct because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The requirement is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That satisfies the scenario without extra changes.
Incorrect Answers
Answer A is incorrect because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The deciding need is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This would not produce the requested result.
Answer B is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. Operationally, the team must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That feature addresses another administration need.
Answer D is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. For this design, the team must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This misses the scenario’s key constraint.
Question 16
An Azure administrator for Northwind Traders learns that the environment has application servers consumed only by internal VNet clients and requires a single private service address. What should be done? Choose ONE.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Use a Standard internal Azure Load Balancer with a private frontend IP
Correct Answer: D
Correct Answer
Answer D is correct because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The scenario requires the team to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This produces the required Azure behavior.
Incorrect Answers
Answer A is incorrect because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The requested outcome is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That leaves the required outcome unmet.
Answer B is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. For this design, the team must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This is adjacent, but not sufficient.
Answer C is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. Here the administrator must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That behavior differs from the requirement.
Question 17
A cloud engineer at Litware is working with a design that uses an HTTP application that listens on port 8080 at /healthz but the current probe checks port 80 and marks every backend down. What is required? Choose ONE.
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
- Configure a load-balancing rule that maps the frontend flow to the backend pool and health probe
- Use an inbound NAT rule for port-specific access to one backend instance
- Allow the AzureLoadBalancer service tag to reach the health-probe port through the NSG
Correct Answer: A
Correct Answer
Answer A is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. The requested outcome is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That is the best fit here.
Incorrect Answers
Answer B is incorrect because An Azure Load Balancer rule defines how frontend IP and port traffic is distributed to a backend pool and associates the health probe used to determine which backend instances can receive new flows. The key requirement is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This misses the scenario’s key constraint.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. Here the administrator must make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That does not meet the deciding constraint.
Answer D is incorrect because Azure Load Balancer IPv4 health probes originate from the Azure platform address represented by the AzureLoadBalancer service tag. Blocking the probe in an NSG or guest firewall causes healthy backends to be marked down. The deciding need is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This solves a different Azure problem.
Question 18
During an operational review at City Power & Light, the team finds that the environment is seeing connection-refused probe results because the probe port does not match the port on which the backend process listens. What should the administrator use? Choose ONE.
- Configure a load-balancing rule that maps the frontend flow to the backend pool and health probe
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
- Use an inbound NAT rule for port-specific access to one backend instance
- Allow the AzureLoadBalancer service tag to reach the health-probe port through the NSG
Correct Answer: B
Correct Answer
Answer B is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. The key requirement is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because An Azure Load Balancer rule defines how frontend IP and port traffic is distributed to a backend pool and associates the health probe used to determine which backend instances can receive new flows. The requirement is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That behavior differs from the requirement.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The deciding need is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This would not produce the requested result.
Answer D is incorrect because Azure Load Balancer IPv4 health probes originate from the Azure platform address represented by the AzureLoadBalancer service tag. Blocking the probe in an NSG or guest firewall causes healthy backends to be marked down. Operationally, the team must make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That feature addresses another administration need.
Question 19
At Northwind Traders, the team is replacing direct public VM endpoints with one public frontend and requires unhealthy instances to leave the rotation automatically. Which option best meets the requirement? Choose TWO.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
- Create a CNAME record for the subdomain
Correct Answers: A, D
Correct Answers
Answer A is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That directly meets the stated constraint.
Answer D is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. The scenario requires the team to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This produces the required Azure behavior.
Incorrect Answers
Answer B is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The requested outcome is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That leaves the required outcome unmet.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. For this design, the team must publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This is adjacent, but not sufficient.
Answer E is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. Here the administrator must publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That behavior differs from the requirement.
Question 20
During an operational review at Consolidated Messenger, the team finds that the environment is building a new public TCP service with three backend VMs and must avoid sending new traffic to a failed application instance. What should the administrator use? Choose TWO.
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Create a CNAME record for the subdomain
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
Correct Answers: B, E
Correct Answers
Answer B is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. Here the administrator must publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This directly implements the requested outcome.
Answer E is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. The requested outcome is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That is the best fit here.
Incorrect Answers
Answer A is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The key requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This misses the scenario’s key constraint.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. Here the administrator must publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That does not meet the deciding constraint.
Answer D is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The deciding need is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This solves a different Azure problem.
