Examkin

Question

Difficulty: Very hardConfigure Azure Load Balancer

You are configuring a public-facing Azure Load Balancer named `LB1` using the Standard SKU. The load balancer will distribute inbound internet traffic to three standalone virtual machines: `VM1`, `VM2`, and `VM3` located in the same Virtual Network `VNet1`.

The virtual machines are configured as follows:
- `VM1` is deployed in Availability Zone 1. Its primary network interface is associated with a Standard SKU public IP address named `Pip1`.
- `VM2` is deployed in Availability Zone 2. Its primary network interface is associated with a Basic SKU public IP address named `Pip2`.
- `VM3` is deployed in Availability Zone 2 and does not have any public IP address assigned to its network interface.

You need to ensure that `VM1`, `VM2`, and `VM3` can be successfully added to the backend pool of `LB1` and are able to receive load-balanced traffic.

Which two actions should you perform?

  1. Upgrade Pip2 to a Standard SKU public IP address, or disassociate Pip2 from the network interface of VM2.Answer
  2. Associate a Network Security Group (NSG) with the network interfaces or subnets of the virtual machines, and configure an inbound security rule to allow the load-balanced traffic.Answer
  3. C
    Change the SKU of LB1 from Standard to Basic.
  4. D
    Create and associate a Basic SKU public IP address with the network interface of VM3.

Answer

The correct configurations are to upgrade the public IP of the second virtual machine to a Standard SKU public IP (or disassociate it), and to associate a Network Security Group (NSG) with the virtual machines' network interfaces or subnets containing an inbound rule that allows the load-balanced traffic.
To successfully deploy virtual machines in the backend pool of a Standard Load Balancer, any public IP addresses directly associated with their network interfaces must match the Standard SKU of the load balancer. Therefore, the Basic SKU public IP on the second virtual machine must be upgraded or disassociated. Additionally, because Standard SKU public IP addresses and Standard Load Balancers are secure by default, a Network Security Group (NSG) must be associated and configured with an inbound rule to allow the load-balanced traffic to reach the virtual machines.

Step-by-Step Solution

1
Evaluate SKU compatibility for the public IP addresses on the virtual machines.
Identify that the second virtual machine has a Basic SKU public IP assigned to its network interface, which is incompatible with the Standard Load Balancer backend pool.
Azure Standard Load Balancer requires all assigned public IP addresses on backend NICs to use the Standard SKU.
2
Select the correct action to resolve the public IP SKU mismatch.
Disassociate the Basic SKU public IP from the second virtual machine, or upgrade it to the Standard SKU.
This removes the SKU mismatch restriction and allows the virtual machine to join the Standard Load Balancer backend pool.
3
Evaluate network security requirements for Standard SKU load balancing.
Acknowledge that Standard Load Balancer frontends and backend pools are secure by default and reject traffic without explicit permissions.
Network Security Groups (NSGs) must be attached to the subnets or network interfaces of the backend VMs, with inbound rules configured to permit the load-balanced traffic.
4
Analyze why changing the load balancer SKU to Basic is invalid.
Confirm that Basic Load Balancers do not support Availability Zones (which the first virtual machine uses) or backend pools consisting of multiple standalone virtual machines.
Basic Load Balancer backend pools are restricted to a single Availability Set or Virtual Machine Scale Set.

Key Concept

Azure Standard Load Balancer backend pool and IP SKU compatibility, zone redundancy, and default security behaviors.
Rate this question

Topics

Configure Azure Load Balancer

More questions from this topic