Pass Your Microsoft AZ-104 Exam Easy!

The nearby action 'Match frontend listener IP/port and backend mapping to the required client contract' is associated with this separate need: a TCP client connects to port 8080, but the load balancer frontend is configured only for 8443. That is because an existing public IP alone cannot make an unconfigured port reach the workload. Here a database backend should be reachable by private subnet consumers but not the internet, so 'Match frontend listener IP/port and backend mapping to the required client contract' misses the fact that internal load balancing exposes a private address; a public frontend changes exposure. 'Use an internal Azure Load Balancer with a private frontend IP' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Distribute eligible backends across supported zones with matching health-aware routing' solves another task because a resilient frontend is ineffective if all backend instances share one failed zone. For the situation where a database backend should be reachable by private subnet consumers but not the internet, this distractor misses the requirement that internal load balancing exposes a private address; a public frontend changes exposure. Unlike 'Distribute eligible backends across supported zones with matching health-aware routing', 'Use an internal Azure Load Balancer with a private frontend IP' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an Azure Load Balancer backend pool exists but a new VM is never selected, the action 'Add the correct NIC/IP configuration to the intended backend pool' can be relevant: a backend VM does not join a load balancer merely by sharing its resource group. For the different problem of a database backend should be reachable by private subnet consumers but not the internet, 'Add the correct NIC/IP configuration to the intended backend pool' misses the mechanism that internal load balancing exposes a private address; a public frontend changes exposure. Choosing 'Add the correct NIC/IP configuration to the intended backend pool' would address that other need, whereas 'Use an internal Azure Load Balancer with a private frontend IP' is intended to solve the stated condition.

'Fix the load-balancing rule's backend port to match the service listener' applies to a different feature boundary because a healthy frontend can still deliver packets to the wrong backend port. In the stated scenario where a database backend should be reachable by private subnet consumers but not the internet, 'Fix the load-balancing rule's backend port to match the service listener' does not satisfy the mechanism that internal load balancing exposes a private address; a public frontend changes exposure. The necessary action is 'Use an internal Azure Load Balancer with a private frontend IP', which should be checked against this Azure resource's actual permissions and state.

'Match frontend listener IP/port and backend mapping to the required client contract' solves another task because an existing public IP alone cannot make an unconfigured port reach the workload. For the situation where a service must accept internet TCP traffic across several VM backends, this distractor misses the requirement that an internet service requires an externally reachable frontend plus listener and backend configuration. Unlike 'Match frontend listener IP/port and backend mapping to the required client contract', 'Create a public Azure Load Balancer frontend with compatible public IP' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an Azure Load Balancer backend pool exists but a new VM is never selected, the action 'Add the correct NIC/IP configuration to the intended backend pool' can be relevant: a backend VM does not join a load balancer merely by sharing its resource group. For the different problem of a service must accept internet TCP traffic across several VM backends, 'Add the correct NIC/IP configuration to the intended backend pool' misses the mechanism that an internet service requires an externally reachable frontend plus listener and backend configuration. Choosing 'Add the correct NIC/IP configuration to the intended backend pool' would address that other need, whereas 'Create a public Azure Load Balancer frontend with compatible public IP' is intended to solve the stated condition.

'Define backend pool membership, health probe and load-balancing rule for the frontend' applies to a different feature boundary because the rule maps frontend port to backends; the probe determines eligible instances. In the stated scenario where a service must accept internet TCP traffic across several VM backends, 'Define backend pool membership, health probe and load-balancing rule for the frontend' does not satisfy the mechanism that an internet service requires an externally reachable frontend plus listener and backend configuration. The necessary action is 'Create a public Azure Load Balancer frontend with compatible public IP', which should be checked against this Azure resource's actual permissions and state.

'Configure only a frontend public IP without an inbound port rule' fails the stated scenario where three VMs provide one TCP application and must receive requests under one endpoint because a frontend address alone cannot forward application traffic to a backend pool. The required multi-part resolution instead needs the rule maps frontend port to backends; the probe determines eligible instances, which 'Configure only a frontend public IP without an inbound port rule' does not establish. Do not count 'Configure only a frontend public IP without an inbound port rule' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Create the backend VMs but leave them outside the intended pool' fails the stated scenario where three VMs provide one TCP application and must receive requests under one endpoint because unregistered VMs cannot be selected as eligible load-balancer backends. The required multi-part resolution instead needs the rule maps frontend port to backends; the probe determines eligible instances, which 'Create the backend VMs but leave them outside the intended pool' does not establish. Do not count 'Create the backend VMs but leave them outside the intended pool' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

'Point the health probe at an unrelated closed port and treat failures as healthy' fails the stated scenario where three VMs provide one TCP application and must receive requests under one endpoint because unmatched probing can cause every valid backend to be excluded from service. The required multi-part resolution instead needs the rule maps frontend port to backends; the probe determines eligible instances, which 'Point the health probe at an unrelated closed port and treat failures as healthy' does not establish. Do not count 'Point the health probe at an unrelated closed port and treat failures as healthy' among the mandatory actions; confirm the specific service's effective permissions, network path, or deployment result before treating the design as complete.

When three VMs provide one TCP application and must receive requests under one endpoint, the action 'Define backend pool membership, health probe and load-balancing rule for the frontend' can be relevant: the rule maps frontend port to backends; the probe determines eligible instances. For the different problem of a load balancer marks an unhealthy instance even though the main app responds on a different port, 'Define backend pool membership, health probe and load-balancing rule for the frontend' misses the mechanism that a probe is a health signal, not the same object as the client's inbound load-balancing rule. Choosing 'Define backend pool membership, health probe and load-balancing rule for the frontend' would address that other need, whereas 'Set a supported health probe matching a reliable application listener' is intended to solve the stated condition.

'Use an internal Azure Load Balancer with a private frontend IP' applies to a different feature boundary because internal load balancing exposes a private address; a public frontend changes exposure. In the stated scenario where a load balancer marks an unhealthy instance even though the main app responds on a different port, 'Use an internal Azure Load Balancer with a private frontend IP' does not satisfy the mechanism that a probe is a health signal, not the same object as the client's inbound load-balancing rule. The necessary action is 'Set a supported health probe matching a reliable application listener', which should be checked against this Azure resource's actual permissions and state.

A Load Balancer health probe checks a configured backend destination; the public frontend port is not automatically a usable listener on each VM. If the backend does not accept traffic on the selected probe port, that probe can fail despite a separate functioning application listener. The question reports that the main application runs on another port and that the instance is marked unhealthy, so the supported probe protocol, port and endpoint must match a real reliable backend health signal. Copying the frontend port into the probe configuration without confirming the backend listener keeps the instance unhealthy rather than diagnosing it.

The nearby action 'Add the correct NIC/IP configuration to the intended backend pool' is associated with this separate need: an Azure Load Balancer backend pool exists but a new VM is never selected. That is because a backend VM does not join a load balancer merely by sharing its resource group. Here a regional load-balanced service must tolerate one zone becoming unavailable, so 'Add the correct NIC/IP configuration to the intended backend pool' misses the fact that a resilient frontend is ineffective if all backend instances share one failed zone. 'Distribute eligible backends across supported zones with matching health-aware routing' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Create a public Azure Load Balancer frontend with compatible public IP' solves another task because an internet service requires an externally reachable frontend plus listener and backend configuration. For the situation where a regional load-balanced service must tolerate one zone becoming unavailable, this distractor misses the requirement that a resilient frontend is ineffective if all backend instances share one failed zone. Unlike 'Create a public Azure Load Balancer frontend with compatible public IP', 'Distribute eligible backends across supported zones with matching health-aware routing' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a database backend should be reachable by private subnet consumers but not the internet, the action 'Use an internal Azure Load Balancer with a private frontend IP' can be relevant: internal load balancing exposes a private address; a public frontend changes exposure. For the different problem of a regional load-balanced service must tolerate one zone becoming unavailable, 'Use an internal Azure Load Balancer with a private frontend IP' misses the mechanism that a resilient frontend is ineffective if all backend instances share one failed zone. Choosing 'Use an internal Azure Load Balancer with a private frontend IP' would address that other need, whereas 'Distribute eligible backends across supported zones with matching health-aware routing' is intended to solve the stated condition.

An internal load balancer provides a private frontend for clients on permitted private networks, which is useful when the service should not be reached from the public internet. But its internal frontend does not itself supply internet SNAT for backend VMs. Those instances still require a supported outbound path such as NAT Gateway, instance-level public IPs or an appropriate outbound-only load-balancer arrangement. The stem asks why outbound internet connections are unreliable, so switching to an internal frontend alone leaves the missing translation and port-capacity design unresolved.

Backend-pool membership determines which VM network interfaces or IP configurations can receive traffic from a load-balancing rule. Correct membership is necessary for inbound distribution, but that operation neither guarantees outbound internet connectivity nor allocates sufficient source-translation ports to each backend. In Azure Load Balancer configurations, explicit outbound rules use a frontend and backend pool with a separate SNAT allocation decision. This problem identifies outbound capacity and source-IP predictability, so membership inspection is only one supporting prerequisite after an actual egress mechanism has been selected.

A health probe checks backend service readiness and helps a load-balancing rule avoid directing inbound traffic to unhealthy instances. Even a successful probe on the application's listener does not prove that the same VM can open high numbers of new outbound internet connections; the two flows use different mechanisms. SNAT-port exhaustion can cause outbound connection failures while an inbound probe remains healthy. Keep a suitable health probe for the inbound service, but solve this question by validating the configured egress path and its source-translation capacity rather than changing probe frequency or port.

Creating a public frontend may be appropriate for a public-facing application and can make public IP addresses available for outbound rules, but a frontend address alone does not declare adequate outbound SNAT capacity. Azure Load Balancer's default allocation can be limited, and some inbound rules do not automatically provide usable outbound translation. The team must configure the permitted outbound method and account for concurrent destinations, backend count and per-IP port allocation. Use explicit outbound rules or a NAT Gateway where appropriate; simply attaching another public frontend without those controls is an incomplete egress plan.

'Inspect NSG rules affecting probe source and backend traffic' solves another task because load balancing still depends on network security allowing required probe and application flows. For the situation where a web app needs path-based routing and TLS termination, while a team proposes only layer-four Load Balancer rules, this distractor misses the requirement that layer 4 balancing uses transport ports, not URL path or HTTP host processing. Unlike 'Inspect NSG rules affecting probe source and backend traffic', 'Evaluate Application Gateway HTTP-layer routing and TLS features' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a regional load-balanced service must tolerate one zone becoming unavailable, the action 'Distribute eligible backends across supported zones with matching health-aware routing' can be relevant: a resilient frontend is ineffective if all backend instances share one failed zone. For the different problem of a web app needs path-based routing and TLS termination, while a team proposes only layer-four Load Balancer rules, 'Distribute eligible backends across supported zones with matching health-aware routing' misses the mechanism that layer 4 balancing uses transport ports, not URL path or HTTP host processing. Choosing 'Distribute eligible backends across supported zones with matching health-aware routing' would address that other need, whereas 'Evaluate Application Gateway HTTP-layer routing and TLS features' is intended to solve the stated condition.

The nearby action 'Use an internal Azure Load Balancer with a private frontend IP' is associated with this separate need: a database backend should be reachable by private subnet consumers but not the internet. That is because internal load balancing exposes a private address; a public frontend changes exposure. Here a web app needs path-based routing and TLS termination, while a team proposes only layer-four Load Balancer rules, so 'Use an internal Azure Load Balancer with a private frontend IP' misses the fact that layer 4 balancing uses transport ports, not URL path or HTTP host processing. 'Evaluate Application Gateway HTTP-layer routing and TLS features' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Set a supported health probe matching a reliable application listener' solves another task because a probe is a health signal, not the same object as the client's inbound load-balancing rule. For the situation where a web app needs path-based routing and TLS termination, while a team proposes only layer-four Load Balancer rules, this distractor misses the requirement that layer 4 balancing uses transport ports, not URL path or HTTP host processing. Unlike 'Set a supported health probe matching a reliable application listener', 'Evaluate Application Gateway HTTP-layer routing and TLS features' directly targets that requirement; its success must be confirmed at the authorized resource scope.

A load-balancer frontend defines the client-facing address, but a frontend alone cannot register a new VM as an eligible backend. The question specifies that the backend pool exists and the new VM is never selected. The immediate association to inspect is whether the intended NIC or IP configuration is a member of that backend pool; health probes and rules matter only after the backend is appropriately associated and healthy. Adding another frontend cannot fix missing backend membership and could create unneeded public exposure if misconfigured.

'Use an internal Azure Load Balancer with a private frontend IP' applies to a different feature boundary because internal load balancing exposes a private address; a public frontend changes exposure. In the stated scenario where an Azure Load Balancer backend pool exists but a new VM is never selected, 'Use an internal Azure Load Balancer with a private frontend IP' does not satisfy the mechanism that a backend VM does not join a load balancer merely by sharing its resource group. The necessary action is 'Add the correct NIC/IP configuration to the intended backend pool', which should be checked against this Azure resource's actual permissions and state.

'Create a public Azure Load Balancer frontend with compatible public IP' solves another task because an internet service requires an externally reachable frontend plus listener and backend configuration. For the situation where an Azure Load Balancer backend pool exists but a new VM is never selected, this distractor misses the requirement that a backend VM does not join a load balancer merely by sharing its resource group. Unlike 'Create a public Azure Load Balancer frontend with compatible public IP', 'Add the correct NIC/IP configuration to the intended backend pool' directly targets that requirement; its success must be confirmed at the authorized resource scope.

The evidence shows that HTTP on port 8080 can reach the healthy application: /healthz succeeds there. Altering port or protocol without aligning the health path introduces another unknown and leaves the recorded /health 404 untouched. For an HTTP health probe, the selected request path must return the expected successful status. The specific repair is to update the path to the verified /healthz endpoint and observe the health transition; unrelated port experiments are not the smallest warranted change.

'Inspect NSG rules affecting probe source and backend traffic' solves another task because load balancing still depends on network security allowing required probe and application flows. For the situation where a backend appears Unhealthy because the probe points to a path returning HTTP 404, this distractor misses the requirement that probe results reflect the configured test, which may differ from a user's working URL. Unlike 'Inspect NSG rules affecting probe source and backend traffic', 'Correct the probe path or application health endpoint and verify expected status' directly targets that requirement; its success must be confirmed at the authorized resource scope.

An unhealthy HTTP probe returning 404 is failing its expected success-status test. Increasing probe thresholds may change when failures are reported, but an endpoint that persistently returns a non-success response is not made healthy by waiting longer. The scenario already provides a working /healthz endpoint on the same known-good protocol and port. Configure that path instead, verify the resulting HTTP response from each backend, and reserve timing adjustments for a separately demonstrated latency or flapping problem.

'Test actual client requests, backend health and required application response' applies to a different feature boundary because resource provisioning success and a green probe do not guarantee end-to-end business behavior. In the stated scenario where a backend appears Unhealthy because the probe points to a path returning HTTP 404, 'Test actual client requests, backend health and required application response' does not satisfy the mechanism that probe results reflect the configured test, which may differ from a user's working URL. The necessary action is 'Correct the probe path or application health endpoint and verify expected status', which should be checked against this Azure resource's actual permissions and state.

Azure Load Balancer health probes determine whether a backend endpoint is healthy enough to receive flows, but a probe alone does not create a listener or load-balancing mapping for another frontend port. The case explicitly has working port 80 connectivity and no configured rule for TCP 443. Reusing the port-80 pool in a new probe while leaving 443 unmapped cannot deliver 443 client traffic. Add the specific 443 frontend-to-backend load-balancing rule, with an appropriate backend listener and probe, after confirming application TLS handling.

The guest firewall can allow or block traffic that arrives at the VM, but it cannot create an Azure Load Balancer frontend rule that does not exist. The question identifies the missing TCP 443 load-balancing rule as the cause of the unreachable port. Permitting 443 at the VM while leaving the load balancer unmapped still provides no forwarding path from the public frontend to that service. Configure the appropriate frontend port and backend mapping, then verify guest firewall and listener settings as separate later checks.

When a public load balancer forwards client TCP 443 to backend port 80, but backends listen on 8443, the action 'Fix the load-balancing rule's backend port to match the service listener' can be relevant: a healthy frontend can still deliver packets to the wrong backend port. For the different problem of the public IP accepts connections to port 80 but no load-balancing rule exists for port 443, 'Fix the load-balancing rule's backend port to match the service listener' misses the mechanism that health probes alone do not forward arbitrary client ports to backend services. Choosing 'Fix the load-balancing rule's backend port to match the service listener' would address that other need, whereas 'Configure the missing supported frontend-to-backend 443 rule and listener path' is intended to solve the stated condition.

An HTTP path is meaningful for HTTP or HTTPS application-layer probes, but this health check uses raw TCP on port 8080. There is no URL path to rewrite. The service listener and the configured TCP probe protocol and port have already been confirmed, so a path mismatch cannot explain the failure. The evidence identifies a priority-100 network security group deny that matches the Azure Load Balancer probe source address. Fix that specific rule under change control rather than altering an unrelated HTTP endpoint or continuing to probe through a blocked network path.

A load-balancing rule maps client frontend traffic to backend destinations; it is different from the health-probe connection that marks a backend eligible. This case states the health probe itself uses the correct TCP 8080 port but is blocked by an effective NSG deny for its source IP. Changing only the frontend-to-backend port rule cannot bypass the NSG rule that denies the probe. A port mapping adjustment might fix client traffic in another incident, but the observed failure here requires allowing the probe's specific source and destination tuple.

Moving the probe to a known closed port makes reachability worse, and increasing a failure threshold does not turn denied packets into successful health checks. The backend listens on TCP 8080; the existing probe uses that port correctly. Its failure comes from a high-priority matching NSG rule, not transient application restarts or a noisy probe interval. Correct the effective network security rule while retaining a supported probe that tests the actual listener, then validate the health status after NSG propagation and application availability checks.