Load Balancer practice questions

You have an Azure load balancer in front of two virtual machines. The load balancer reports both instances as unavailable even though the VMs are running. What is the most likely cause?

Trap 1: The VMs are in an availability set.

Being in an availability set does not make them unavailable to the load balancer.

Trap 2: The storage account uses the Cool tier.

Storage tier has no direct relationship to load balancer backend health.

Trap 3: The subscription has a budget alert.

Budget alerts do not affect load balancer backend availability.

A
The health probe is failing.
A failed health probe causes the load balancer to mark backend instances as unavailable.
B
The VMs are in an availability set.
Why wrong: Being in an availability set does not make them unavailable to the load balancer.
C
The storage account uses the Cool tier.
Why wrong: Storage tier has no direct relationship to load balancer backend health.
D
The subscription has a budget alert.
Why wrong: Budget alerts do not affect load balancer backend availability.

Question 2hardmultiple choice

Two virtual machines named VM-Web01 and VM-Web02 host the same public web application. Users on the internet must connect through a single public IP address, and incoming requests should be distributed across both VMs. What should you deploy?

Trap 1: An internal load balancer

An internal load balancer would not expose a public IP to internet users.

Trap 2: A private DNS zone

DNS alone does not provide health-based load balancing across the VMs in this way.

Trap 3: A Recovery Services vault

A Recovery Services vault is for backup and recovery.

A
An internal load balancer
Why wrong: An internal load balancer would not expose a public IP to internet users.
B
A public load balancer
This fits the requirement for a single public IP and traffic distribution.
C
A private DNS zone
Why wrong: DNS alone does not provide health-based load balancing across the VMs in this way.
D
A Recovery Services vault
Why wrong: A Recovery Services vault is for backup and recovery.

Question 3mediummultiple choice

A web application runs on three VMs in a backend subnet. The backend team wants the load balancer in the frontend tier to reach the VMs on TCP 8443, and they want the rule to keep working even if the backend VM IP addresses change. What should you use in the NSG rule?

Trap 1: Use the individual private IP addresses of each backend VM as the…

This works only while the VM IPs stay the same and does not simplify rule maintenance when addresses change.

Trap 2: Use the VirtualNetwork service tag for both source and destination.

This is too broad because it can allow traffic from many resources inside the virtual network, not just the frontend tier.

Trap 3: Create a route table entry that sends TCP 8443 traffic to the…

Route tables control next-hop selection, not security filtering. They cannot allow or deny traffic on a port.

A
Use the individual private IP addresses of each backend VM as the source.
Why wrong: This works only while the VM IPs stay the same and does not simplify rule maintenance when addresses change.
B
Use an application security group for the frontend tier as the source and another ASG for the backend tier as the destination.
Application security groups let you reference groups of NICs instead of hard-coded IP addresses. That makes the NSG rule resilient when VMs are replaced or reimaged and their private IP addresses change. It also keeps the access model aligned to application tiers rather than infrastructure details, which is the preferred design for maintainable network security rules.
C
Use the VirtualNetwork service tag for both source and destination.
Why wrong: This is too broad because it can allow traffic from many resources inside the virtual network, not just the frontend tier.
D
Create a route table entry that sends TCP 8443 traffic to the backend subnet.
Why wrong: Route tables control next-hop selection, not security filtering. They cannot allow or deny traffic on a port.

Question 4mediumdrag order

Arrange the steps to configure Azure Load Balancer with a backend pool.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 5mediummultiple choice

A team is creating a subnet for 48 small Linux VMs, two internal load balancer frontend IPs, and one Azure Bastion host. Azure reserves five IP addresses in every subnet. Which subnet prefix is the smallest that will still meet the requirement?

Trap 1: /27

A /27 provides only 27 usable IP addresses after Azure reservations, which is not enough for all required resources.

Trap 2: /25

A /25 would work, but it is larger than necessary and wastes address space that could be used elsewhere.

Trap 3: /28

A /28 is far too small for this design and cannot support the number of required private IP addresses.

A
/27
Why wrong: A /27 provides only 27 usable IP addresses after Azure reservations, which is not enough for all required resources.
B
/26
A /26 provides 64 total addresses, and Azure reserves five, leaving 59 usable addresses. That is enough for 48 VMs, two load balancer frontend IPs, and one Bastion host.
C
/25
Why wrong: A /25 would work, but it is larger than necessary and wastes address space that could be used elsewhere.
D
/28
Why wrong: A /28 is far too small for this design and cannot support the number of required private IP addresses.

Review the full routing breakdown →

Question 6mediummultiple choice

A public web application runs on two Windows Server VMs in Azure. Users connect through a single public IP on TCP 443, and the solution must distribute traffic only to healthy VMs without requiring Layer 7 features such as URL-based routing. Which Azure service should the administrator deploy?

Trap 1: Azure Application Gateway.

Application Gateway is a Layer 7 load balancer, which is more than what the scenario requires.

Trap 2: Azure Traffic Manager.

Traffic Manager operates at the DNS layer and directs clients to endpoints, but it does not directly load-balance TCP sessions to VMs.

Trap 3: Azure Front Door.

Front Door is a global HTTP/HTTPS entry point with Layer 7 capabilities, which adds features not requested in this scenario.

A
Azure Application Gateway.
Why wrong: Application Gateway is a Layer 7 load balancer, which is more than what the scenario requires.
B
Azure Load Balancer Standard.
A Standard Load Balancer is the right fit for distributing TCP 443 traffic to healthy backend VMs using a single public IP at Layer 4. It supports health probes and works well for internet-facing workloads that do not need application-level routing. Because the scenario specifically excludes Layer 7 features, the load balancer provides the simplest and most cost-effective design while still meeting availability and traffic distribution requirements.
C
Azure Traffic Manager.
Why wrong: Traffic Manager operates at the DNS layer and directs clients to endpoints, but it does not directly load-balance TCP sessions to VMs.
D
Azure Front Door.
Why wrong: Front Door is a global HTTP/HTTPS entry point with Layer 7 capabilities, which adds features not requested in this scenario.

Question 7mediummultiple choice

You removed public IP addresses from a backend subnet containing 20 VMs. The VMs still need outbound internet access for updates, and the organization wants all outbound traffic to appear from one predictable public IP. No inbound publishing is required. Which Azure service should you use?

Trap 1: A public load balancer with inbound NAT rules for each VM.

Inbound NAT rules are for publishing inbound access, not for simplified outbound-only egress.

Trap 2: A private load balancer with a backend pool of the VMs.

Private load balancing distributes internal traffic but does not provide internet egress from the subnet.

Trap 3: A VPN gateway connection to a remote network.

A VPN gateway is for hybrid connectivity, not for providing predictable outbound internet NAT.

A
A public load balancer with inbound NAT rules for each VM.
Why wrong: Inbound NAT rules are for publishing inbound access, not for simplified outbound-only egress.
B
Azure NAT Gateway associated with the subnet.
NAT Gateway provides outbound-only internet connectivity with a stable public IP or public IP prefix.
C
A private load balancer with a backend pool of the VMs.
Why wrong: Private load balancing distributes internal traffic but does not provide internet egress from the subnet.
D
A VPN gateway connection to a remote network.
Why wrong: A VPN gateway is for hybrid connectivity, not for providing predictable outbound internet NAT.

Question 8mediummultiple choice

Based on the exhibit, which subnet prefix should you create for the workload subnet so it has enough usable IP addresses for all listed resources?

Exhibit

Workload subnet requirements:
- 41 VM NICs
- 2 internal load balancer frontend IP configurations
- 3 private endpoint IPs
- 1 Azure Bastion host
- Azure reserves 5 IP addresses in every subnet

Planned subnet must be a single subnet in one virtual network.

Trap 1: /27

A /27 provides only 32 total addresses, which is not enough for the required workload.

Trap 2: /25

A /25 would work, but it allocates more addresses than necessary for the stated requirement.

Trap 3: /28

A /28 provides only 16 total addresses and is far too small for the workload.

A
/27
Why wrong: A /27 provides only 32 total addresses, which is not enough for the required workload.
B
/26
A /26 provides 64 total addresses and 59 usable addresses, which satisfies the requirement.
C
/25
Why wrong: A /25 would work, but it allocates more addresses than necessary for the stated requirement.
D
/28
Why wrong: A /28 provides only 16 total addresses and is far too small for the workload.

Question 9easymatching