Topic 13 Practice Test 2 covers Azure DNS and Load Balancing for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure name resolution and load balancing. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Northwind Traders is reviewing an Azure configuration that created an Azure DNS zone for a newly purchased public domain and now must make the public namespace authoritative. Which action should be selected? Choose ONE.
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Use an Azure Private DNS zone and link the required virtual network
- Create or update an A record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: A
Correct Answer
Answer A is correct because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. Operationally, the team must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That is the best fit here.
Incorrect Answers
Answer B is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. For this design, the team must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This misses the scenario’s key constraint.
Answer C is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The scenario requires the team to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That does not meet the deciding constraint.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The requested outcome is to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This solves a different Azure problem.
Question 2
Wingtip Toys is standardizing public DNS on Azure and must update the registrar so the domain is delegated to the name servers assigned to the Azure zone. What should the Azure administrator configure? Choose ONE.
- Use an Azure Private DNS zone and link the required virtual network
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Create or update an A record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: B
Correct Answer
Answer B is correct because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. For this design, the team must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. Here the administrator must host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That behavior differs from the requirement.
Answer C is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requested outcome is to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. This would not produce the requested result.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The key requirement is to host authoritative public DNS in Azure and complete parent-domain delegation to the Azure name servers. That feature addresses another administration need.
Question 3
City Power & Light needs the zone record for files to return an IPv4 address rather than another DNS host name. Choose the most appropriate Azure configuration. Choose ONE.
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Create or update an A record set
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: C
Correct Answer
Answer C is correct because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. Here the administrator must map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That directly meets the stated constraint.
Incorrect Answers
Answer A is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The deciding need is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This solves a different Azure problem.
Answer B is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The key requirement is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That leaves the required outcome unmet.
Answer D is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The requirement is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This is adjacent, but not sufficient.
Question 4
Litware is replacing an obsolete address for a web host and the DNS answer must be the new IPv4 address itself. What should the Azure administrator configure? Choose ONE.
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Use an Azure Private DNS zone and link the required virtual network
- Create or update an A record set
Correct Answer: D
Correct Answer
Answer D is correct because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The deciding need is to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This directly implements the requested outcome.
Incorrect Answers
Answer A is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. Operationally, the team must map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That feature addresses another administration need.
Answer B is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. For this design, the team must map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. This misses the scenario’s key constraint.
Answer C is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The scenario requires the team to map a public host name directly to a known IPv4 endpoint by using the correct DNS record type. That does not meet the deciding constraint.
Question 5
Consolidated Messenger is publishing a branded subdomain that should resolve through a vendor-provided canonical host name. Choose the most appropriate Azure configuration. Choose ONE.
- Create a CNAME record for the subdomain
- Create or update an A record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Change the TTL on the Azure DNS record set
Correct Answer: A
Correct Answer
Answer A is correct because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The requested outcome is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That matches the requested operational result.
Incorrect Answers
Answer B is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. For this design, the team must map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This is adjacent, but not sufficient.
Answer C is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. Here the administrator must map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That behavior differs from the requirement.
Answer D is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. The requested outcome is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This would not produce the requested result.
Question 6
In Northwind Traders’s Azure environment, the organization wants users to browse help.contoso.com while DNS points that name to a separate canonical hostname managed by another team. Which choice is the best fit? Choose ONE.
- Create or update an A record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Change the TTL on the Azure DNS record set
Correct Answer: B
Correct Answer
Answer B is correct because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The key requirement is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This meets the deciding technical requirement.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. Here the administrator must map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That does not meet the deciding constraint.
Answer C is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The deciding need is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. This solves a different Azure problem.
Answer D is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. The key requirement is to map a non-apex friendly subdomain to another canonical DNS host name rather than to a numeric address. That leaves the required outcome unmet.
Question 7
Litware is reviewing an Azure configuration that uses an Azure-hosted public frontend at the root domain and requires an Azure-native alias rather than a fixed address value. Which action should be selected? Choose ONE.
- Create or update an A record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
- Change the TTL on the Azure DNS record set
Correct Answer: C
Correct Answer
Answer C is correct because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The requirement is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That satisfies the scenario without extra changes.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The deciding need is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This would not produce the requested result.
Answer B is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. Operationally, the team must use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That feature addresses another administration need.
Answer D is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. For this design, the team must use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This misses the scenario’s key constraint.
Question 8
In Fabrikam’s Azure environment, the organization cannot use a normal CNAME at the zone apex because the apex already contains mandatory SOA and NS records. Which choice is the best fit? Choose ONE.
- Create or update an A record set
- Create a CNAME record for the subdomain
- Change the TTL on the Azure DNS record set
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: D
Correct Answer
Answer D is correct because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The scenario requires the team to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This produces the required Azure behavior.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requested outcome is to use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That leaves the required outcome unmet.
Answer B is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. For this design, the team must use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. This is adjacent, but not sufficient.
Answer C is incorrect because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. Here the administrator must use an apex-compatible DNS record that tracks the targeted Azure public IP resource instead of hard-coding its current address. That behavior differs from the requirement.
Question 9
Proseware is reviewing an Azure configuration that is preparing a blue-green endpoint change and the current one-hour cache lifetime is too long for the planned cutover window. Which action should be selected? Choose ONE.
- Change the TTL on the Azure DNS record set
- Create or update an A record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: A
Correct Answer
Answer A is correct because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. The requested outcome is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That is the best fit here.
Incorrect Answers
Answer B is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The key requirement is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This misses the scenario’s key constraint.
Answer C is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. Here the administrator must reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That does not meet the deciding constraint.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. The deciding need is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This solves a different Azure problem.
Question 10
Consolidated Messenger is troubleshooting why users continue receiving yesterday’s address even after the authoritative record changed and wants future changes to age out faster. What should the Azure administrator configure? Choose ONE.
- Create or update an A record set
- Change the TTL on the Azure DNS record set
- Create a CNAME record for the subdomain
- Create an Azure DNS alias A record that targets the Azure public IP resource
Correct Answer: B
Correct Answer
Answer B is correct because DNS TTL controls how long resolvers and clients may cache a record set before querying authoritative DNS again. Lowering TTL before a planned endpoint change can reduce how long old answers remain cached, at the cost of more DNS queries. The key requirement is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. The requirement is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That behavior differs from the requirement.
Answer C is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The deciding need is to reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. This would not produce the requested result.
Answer D is incorrect because An Azure DNS alias record can reference a supported Azure resource instead of hard-coding its current IP address. An alias A record is useful at the zone apex and can track the targeted Azure public IP resource when its address changes. Operationally, the team must reduce DNS cache lifetime before a planned endpoint cutover so old answers expire sooner. That feature addresses another administration need.
Question 11
Fabrikam must make a private zone resolvable from a newly created VNet by linking that virtual network to the zone. Choose the most appropriate Azure configuration. Choose ONE.
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Create a CNAME record for the subdomain
- Use an Azure Private DNS zone and link the required virtual network
- Create or update an A record set
Correct Answer: C
Correct Answer
Answer C is correct because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The requirement is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That directly meets the stated constraint.
Incorrect Answers
Answer A is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The scenario requires the team to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This solves a different Azure problem.
Answer B is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The requested outcome is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That leaves the required outcome unmet.
Answer D is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. For this design, the team must provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This is adjacent, but not sufficient.
Question 12
Lucerne Publishing needs internal service records available to resources in VNet-App while keeping the namespace private. What should the Azure administrator configure? Choose ONE.
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Create a CNAME record for the subdomain
- Create or update an A record set
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: D
Correct Answer
Answer D is correct because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. Here the administrator must provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This directly implements the requested outcome.
Incorrect Answers
Answer A is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The requested outcome is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That feature addresses another administration need.
Answer B is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The key requirement is to provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. This misses the scenario’s key constraint.
Answer C is incorrect because An A record maps a DNS name to one or more IPv4 addresses. Azure DNS manages records of the same name and type as a record set, including a shared TTL for the records in that set. Here the administrator must provide Azure-hosted private DNS resolution to resources in a virtual network without publishing the records to the internet. That does not meet the deciding constraint.
Question 13
Contoso is publishing a UDP-based service to internet clients and needs Azure-managed Layer 4 load distribution. Choose the most appropriate Azure configuration. Choose ONE.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: A
Correct Answer
Answer A is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The deciding need is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That matches the requested operational result.
Incorrect Answers
Answer B is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The key requirement is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This is adjacent, but not sufficient.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The requirement is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That behavior differs from the requirement.
Answer D is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The deciding need is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This would not produce the requested result.
Question 14
In Proseware’s Azure environment, the organization is replacing direct public IPs on several application VMs with one Standard Load Balancer public frontend. Which choice is the best fit? Choose ONE.
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Use an Azure Private DNS zone and link the required virtual network
Correct Answer: B
Correct Answer
Answer B is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. Operationally, the team must distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This meets the deciding technical requirement.
Incorrect Answers
Answer A is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The requirement is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That does not meet the deciding constraint.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The scenario requires the team to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. This solves a different Azure problem.
Answer D is incorrect because Azure Private DNS provides private name resolution for records in a private DNS zone. Linking a virtual network makes that zone available to resources in the VNet, and supported links can optionally enable automatic registration. The requested outcome is to distribute internet-facing TCP or UDP traffic across healthy Azure backends at Layer 4. That leaves the required outcome unmet.
Question 15
Lucerne Publishing is reviewing an Azure configuration that must provide a stable private frontend IP for a pool of backend VMs used by internal applications. Which action should be selected? Choose ONE.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
Correct Answer: C
Correct Answer
Answer C is correct because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. For this design, the team must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That satisfies the scenario without extra changes.
Incorrect Answers
Answer A is incorrect because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. Here the administrator must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This would not produce the requested result.
Answer B is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The requested outcome is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That feature addresses another administration need.
Answer D is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The key requirement is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This misses the scenario’s key constraint.
Question 16
In Woodgrove Bank’s Azure environment, the organization needs private TCP load distribution for a database proxy tier reached only through connected VNets. Which choice is the best fit? Choose ONE.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Create an Azure DNS public zone and delegate the domain to its Azure name servers
- Use a Standard internal Azure Load Balancer with a private frontend IP
Correct Answer: D
Correct Answer
Answer D is correct because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. Here the administrator must distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This produces the required Azure behavior.
Incorrect Answers
Answer A is incorrect because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The deciding need is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That leaves the required outcome unmet.
Answer B is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The key requirement is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. This is adjacent, but not sufficient.
Answer C is incorrect because An Azure DNS public zone hosts authoritative public DNS records. After the zone is created, the parent or registrar must delegate the domain by using the Azure-assigned name-server records before internet resolvers query Azure DNS authoritatively. The requirement is to distribute private Layer 4 traffic across backends without exposing an internet-facing frontend. That behavior differs from the requirement.
Question 17
Fourth Coffee is reviewing an Azure configuration that has an HTTPS service whose health endpoint changed and the load balancer must test the correct path before routing new connections. Which action should be selected? Choose ONE.
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
- Configure a load-balancing rule that maps the frontend flow to the backend pool and health probe
- Use an inbound NAT rule for port-specific access to one backend instance
- Allow the AzureLoadBalancer service tag to reach the health-probe port through the NSG
Correct Answer: A
Correct Answer
Answer A is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. The deciding need is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That is the best fit here.
Incorrect Answers
Answer B is incorrect because An Azure Load Balancer rule defines how frontend IP and port traffic is distributed to a backend pool and associates the health probe used to determine which backend instances can receive new flows. Operationally, the team must make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This misses the scenario’s key constraint.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The requirement is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That does not meet the deciding constraint.
Answer D is incorrect because Azure Load Balancer IPv4 health probes originate from the Azure platform address represented by the AzureLoadBalancer service tag. Blocking the probe in an NSG or guest firewall causes healthy backends to be marked down. The scenario requires the team to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This solves a different Azure problem.
Question 18
Contoso needs the load balancer to distinguish healthy and unhealthy pool members by testing the service protocol and endpoint actually served. What should the Azure administrator configure? Choose ONE.
- Configure a load-balancing rule that maps the frontend flow to the backend pool and health probe
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
- Use an inbound NAT rule for port-specific access to one backend instance
- Allow the AzureLoadBalancer service tag to reach the health-probe port through the NSG
Correct Answer: B
Correct Answer
Answer B is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. Operationally, the team must make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This is the required platform behavior.
Incorrect Answers
Answer A is incorrect because An Azure Load Balancer rule defines how frontend IP and port traffic is distributed to a backend pool and associates the health probe used to determine which backend instances can receive new flows. For this design, the team must make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That behavior differs from the requirement.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. Here the administrator must make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. This would not produce the requested result.
Answer D is incorrect because Azure Load Balancer IPv4 health probes originate from the Azure platform address represented by the AzureLoadBalancer service tag. Blocking the probe in an NSG or guest firewall causes healthy backends to be marked down. The requested outcome is to make backend health evaluation match the actual application listener so unhealthy instances stop receiving new load-balanced flows. That feature addresses another administration need.
Question 19
Woodgrove Bank must deliver a highly available public Layer 4 endpoint whose backend membership is gated by application health. Choose the most appropriate Azure configuration. Choose TWO.
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
- Create a CNAME record for the subdomain
Correct Answers: A, D
Correct Answers
Answer A is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The key requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That directly meets the stated constraint.
Answer D is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. Here the administrator must publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This produces the required Azure behavior.
Incorrect Answers
Answer B is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. The deciding need is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That leaves the required outcome unmet.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The key requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This is adjacent, but not sufficient.
Answer E is incorrect because A CNAME aliases one DNS name to another host name. It works for non-apex aliases, but it cannot coexist with other record types at the same name or replace apex SOA and NS records. The requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That behavior differs from the requirement.
Question 20
Trey Research needs an internet-routable frontend plus active health evaluation before distributing UDP client flows. What should the Azure administrator configure? Choose TWO.
- Use a Standard internal Azure Load Balancer with a private frontend IP
- Use a Standard public Azure Load Balancer with a public frontend IP
- Use an inbound NAT rule for port-specific access to one backend instance
- Create a CNAME record for the subdomain
- Configure a TCP, HTTP, or HTTPS health probe that matches the backend application listener
Correct Answers: B, E
Correct Answers
Answer B is correct because A public Azure Load Balancer uses a public frontend IP configuration to distribute inbound Layer 4 TCP or UDP traffic across healthy backend instances. It fits internet-facing load balancing without requiring application-layer routing. The requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This directly implements the requested outcome.
Answer E is correct because Load Balancer health probes determine backend availability. The probe protocol, port, and for HTTP or HTTPS the request path must match a healthy application endpoint, or the backend can be marked unhealthy and removed from new-flow rotation. The deciding need is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That is the best fit here.
Incorrect Answers
Answer A is incorrect because An internal Azure Load Balancer uses a private frontend address from a virtual network to distribute Layer 4 traffic. It is appropriate when clients and backends communicate privately and no internet-facing frontend is required. Operationally, the team must publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This misses the scenario’s key constraint.
Answer C is incorrect because An inbound NAT rule maps a frontend IP and port to a specific backend instance and port. It is useful for instance-specific administrative connectivity and differs from a load-balancing rule that distributes client traffic across the backend pool. The requirement is to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. That does not meet the deciding constraint.
Answer D is incorrect because CNAME records point one host name at another canonical name. They suit subdomains, not a zone apex that must retain its required SOA and NS records. The scenario requires the team to publish an internet-facing Layer 4 service and ensure only healthy backend instances receive new client connections. This solves a different Azure problem.
