Pass Your Microsoft AZ-104 Exam Easy!

An HTTP path is meaningful for HTTP or HTTPS application-layer probes, but this health check uses raw TCP on port 8080. There is no URL path to rewrite. The service listener and the configured TCP probe protocol and port have already been confirmed, so a path mismatch cannot explain the failure. The evidence identifies a priority-100 network security group deny that matches the Azure Load Balancer probe source address. Fix that specific rule under change control rather than altering an unrelated HTTP endpoint or continuing to probe through a blocked network path.

A load-balancing rule maps client frontend traffic to backend destinations; it is different from the health-probe connection that marks a backend eligible. This case states the health probe itself uses the correct TCP 8080 port but is blocked by an effective NSG deny for its source IP. Changing only the frontend-to-backend port rule cannot bypass the NSG rule that denies the probe. A port mapping adjustment might fix client traffic in another incident, but the observed failure here requires allowing the probe's specific source and destination tuple.

Moving the probe to a known closed port makes reachability worse, and increasing a failure threshold does not turn denied packets into successful health checks. The backend listens on TCP 8080; the existing probe uses that port correctly. Its failure comes from a high-priority matching NSG rule, not transient application restarts or a noisy probe interval. Correct the effective network security rule while retaining a supported probe that tests the actual listener, then validate the health status after NSG propagation and application availability checks.

The client attempts to connect to TCP 8080 on the public frontend. Azure Load Balancer will not accept that requested frontend port merely because the backend listener changed. The load-balancing rule must have a compatible frontend IP/port mapped to the intended backend port. If the frontend is still defined only for 8443, changing the backend target cannot satisfy the client contract for 8080.

'Configure the missing supported frontend-to-backend 443 rule and listener path' applies to a different feature boundary because health probes alone do not forward arbitrary client ports to backend services. In the stated scenario where a TCP client connects to port 8080, but the load balancer frontend is configured only for 8443, 'Configure the missing supported frontend-to-backend 443 rule and listener path' does not satisfy the mechanism that an existing public IP alone cannot make an unconfigured port reach the workload. The necessary action is 'Match frontend listener IP/port and backend mapping to the required client contract', which should be checked against this Azure resource's actual permissions and state.

'Create a public Azure Load Balancer frontend with compatible public IP' solves another task because an internet service requires an externally reachable frontend plus listener and backend configuration. For the situation where a TCP client connects to port 8080, but the load balancer frontend is configured only for 8443, this distractor misses the requirement that an existing public IP alone cannot make an unconfigured port reach the workload. Unlike 'Create a public Azure Load Balancer frontend with compatible public IP', 'Match frontend listener IP/port and backend mapping to the required client contract' directly targets that requirement; its success must be confirmed at the authorized resource scope.

A different URI path cannot make a raw TCP service perform an HTTPS handshake or return the HTTP response an HTTPS probe expects. Here the only listening backend service is on port 8080 and offers no HTTP/HTTPS endpoint, while the existing probe requests TLS on 9443. Changing `/healthz` to `/` leaves both the protocol and port mismatch in place. The correct probe must use the supported protocol for an available listener and confirm the backend is reachable under the relevant NSG rules.

Changing backend pool membership might be required in a pool-configuration failure, but the case says the intended VMs are already being probed and the failure is a protocol/port mismatch. A new unrelated pool does not change requests that still target HTTPS 9443 at the same backend VMs. Azure makes probe health decisions for a configured pool and listener; resolve the protocol mismatch and verify actual TCP probe success before attributing the failure to backend pool selection.

Retry count and failure threshold determine when a probe marks a backend unhealthy; they do not let an HTTPS request succeed against a raw TCP-only listener on another port. Increasing retries simply repeats an invalid TLS/HTTP request. The administrator must align the configured probe protocol and destination port with what the backend actually serves. Only after that correction would timing thresholds matter for truly slow or intermittent responses.

An NSG can prevent an Azure Load Balancer probe from reaching a VM, and checking it would be appropriate if probe-source traffic were denied. However the question explicitly confirms that the NSG's probe rules were checked and did not change, so repeating that configuration review alone would not reveal which backend instance actually remained eligible when another rebooted. The relevant evidence now is observed probe status and active backend-pool membership over the failure window. Those observations show which endpoints the load balancer could select for new connections.

A backend VM must be associated with the correct load-balancer pool to become eligible for selection, but the case explicitly says every NIC-to-pool association has already been verified. Adding another pool association cannot explain why existing members temporarily lose or regain probe health during a restart. The operator should instead examine historical probe status, backend health and active pool membership while the VM is unavailable, then validate the load balancer still had a healthy target for new traffic. This option repairs a configuration fault that the stated evidence excludes.

A local request to a rebooted VM is one useful data point but cannot establish which instances the Azure Load Balancer considers healthy or where new client flows were sent during the restart. Health-probe results and backend pool membership determine load-balancing eligibility. If the remaining backends were unhealthy or disconnected, a local post-restart test would miss the precise cause of intermittent failures. Correlate probe health, active pool membership and observed client failures across the restart window before declaring the network design resilient.

The public client contract is TCP 443, which must remain available at the load balancer frontend. The failure occurs after forwarding because backend servers actually listen on 8443, not 80. Changing the frontend would break the client-facing interface and still leave the backend mismatch. Correct the rule’s backend destination port, maintain the approved frontend port and validate probe/NSG behavior for the repaired mapping.

'Configure the missing supported frontend-to-backend 443 rule and listener path' applies to a different feature boundary because health probes alone do not forward arbitrary client ports to backend services. In the stated scenario where a public load balancer forwards client TCP 443 to backend port 80, but backends listen on 8443, 'Configure the missing supported frontend-to-backend 443 rule and listener path' does not satisfy the mechanism that a healthy frontend can still deliver packets to the wrong backend port. The necessary action is 'Fix the load-balancing rule's backend port to match the service listener', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Inspect NSG rules affecting probe source and backend traffic' is associated with this separate need: Network tests show a backend is healthy locally but never passes load balancer probes. That is because load balancing still depends on network security allowing required probe and application flows. Here a public load balancer forwards client TCP 443 to backend port 80, but backends listen on 8443, so 'Inspect NSG rules affecting probe source and backend traffic' misses the fact that a healthy frontend can still deliver packets to the wrong backend port. 'Fix the load-balancing rule's backend port to match the service listener' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When Network tests show a backend is healthy locally but never passes load balancer probes, the action 'Inspect NSG rules affecting probe source and backend traffic' can be relevant: load balancing still depends on network security allowing required probe and application flows. For the different problem of after repairing a probe, the Azure resource reports success, 'Inspect NSG rules affecting probe source and backend traffic' misses the mechanism that resource provisioning success and a green probe do not guarantee end-to-end business behavior. Choosing 'Inspect NSG rules affecting probe source and backend traffic' would address that other need, whereas 'Test actual client requests, backend health and required application response' is intended to solve the stated condition.

The nearby action 'Correlate backend probe health and active pool membership with failures' is associated with this separate need: requests become intermittent whenever one backend VM restarts. That is because traffic distribution follows healthy eligible endpoints; app capacity and drain behavior affect reliability. Here after repairing a probe, the Azure resource reports success, so 'Correlate backend probe health and active pool membership with failures' misses the fact that resource provisioning success and a green probe do not guarantee end-to-end business behavior. 'Test actual client requests, backend health and required application response' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a compatible probe protocol, port, and endpoint for the actual app' solves another task because protocol mismatch creates false unhealthy status even when a different listener responds. For the situation where after repairing a probe, the Azure resource reports success, this distractor misses the requirement that resource provisioning success and a green probe do not guarantee end-to-end business behavior. Unlike 'Use a compatible probe protocol, port, and endpoint for the actual app', 'Test actual client requests, backend health and required application response' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a backend appears Unhealthy because the probe points to a path returning HTTP 404, the action 'Correct the probe path or application health endpoint and verify expected status' can be relevant: probe results reflect the configured test, which may differ from a user's working URL. For the different problem of after repairing a probe, the Azure resource reports success, 'Correct the probe path or application health endpoint and verify expected status' misses the mechanism that resource provisioning success and a green probe do not guarantee end-to-end business behavior. Choosing 'Correct the probe path or application health endpoint and verify expected status' would address that other need, whereas 'Test actual client requests, backend health and required application response' is intended to solve the stated condition.

A daily security-log export is too delayed and not necessarily a measurement of VM processor utilization. A CPU threshold requiring notification within minutes should be evaluated against a supported Azure Monitor metric with an appropriate time grain and alert rule. Waiting for yesterday's archived logs makes the system unable to distinguish current CPU pressure from a historical incident. Security logs may help correlate causes, but they are not a substitute for a fresh CPU performance signal or a correctly scheduled metric evaluation.

Azure subscription Activity Log events primarily describe control-plane activity such as resource changes; they do not provide the time-series VM CPU utilization measurements needed to evaluate whether load remains above 90 percent. The operational requirement specifies a near-real-time CPU signal, not deployment history. Azure Monitor platform metrics provide supported numerical CPU observations and can feed a metric alert with chosen aggregation, threshold and evaluation frequency. Treating administrative events as CPU telemetry could miss genuine sustained overload even when no resource configuration changed.

When CPU peaks began near a deployment, and an engineer asserts the deployment caused them, the action 'Correlate deployment events with workload metrics and test alternative causes' can be relevant: temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. For the different problem of operations want an alert within minutes of VM CPU over 90%, but a colleague suggests parsing one-day-old security logs, 'Correlate deployment events with workload metrics and test alternative causes' misses the mechanism that platform metrics suit near-real-time numeric thresholds; logs are for queryable events and detail. Choosing 'Correlate deployment events with workload metrics and test alternative causes' would address that other need, whereas 'Use an Azure Monitor platform metric with suitable time grain' is intended to solve the stated condition.

The nearby action 'Verify resource selection, scope and availability of the particular metric' is associated with this separate need: a dashboard shows no CPU metric for a VM newly selected in the wrong subscription scope. That is because missing chart data may reflect query scope rather than zero CPU load. Here a monitoring rule must warn only when CPU remains high for five minutes, not during one brief spike, so 'Verify resource selection, scope and availability of the particular metric' misses the fact that time grain and aggregation determine whether transient peaks satisfy the alert condition. 'Choose sustained aggregation and evaluation windows for the CPU metric' is the more defensible action; confirm its behavior in the target service before calling the task complete.

The Maximum of a one-minute window is sensitive to isolated high samples, which is precisely the behavior the prompt rejects. A one-minute spike above 70 percent could trigger even when the following four minutes are normal. To implement the specified sustained condition, set a five-minute aggregation window and an appropriate Average CPU metric criterion above 70 percent, then choose supported evaluation frequency. Use the metric's available time granularity and validate with a simulated short spike and a sustained load episode.

When an operator edits an action group thinking that changes which CPU value makes the alert fire, the action 'Define the threshold in the alert rule and recipients in the action group' can be relevant: action group configuration handles response delivery, not the measured alert condition. For the different problem of a monitoring rule must warn only when CPU remains high for five minutes, not during one brief spike, 'Define the threshold in the alert rule and recipients in the action group' misses the mechanism that time grain and aggregation determine whether transient peaks satisfy the alert condition. Choosing 'Define the threshold in the alert rule and recipients in the action group' would address that other need, whereas 'Choose sustained aggregation and evaluation windows for the CPU metric' is intended to solve the stated condition.

The nearby action 'Use an Azure Monitor platform metric with suitable time grain' is associated with this separate need: operations want an alert within minutes of VM CPU over 90%, but a colleague suggests parsing one-day-old security logs. That is because platform metrics suit near-real-time numeric thresholds; logs are for queryable events and detail. Here a monitoring rule must warn only when CPU remains high for five minutes, not during one brief spike, so 'Use an Azure Monitor platform metric with suitable time grain' misses the fact that time grain and aggregation determine whether transient peaks satisfy the alert condition. 'Choose sustained aggregation and evaluation windows for the CPU metric' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Evaluate the rule's actual aggregation and evaluation periods' solves another task because a single peak is insufficient when a sustained aggregate is the configured predicate. For the situation where most requests are fast but a small subset exceeds the latency SLA; average latency looks normal, this distractor misses the requirement that percentiles expose tail latency hidden by a low average and should use comparable sample windows. Unlike 'Evaluate the rule's actual aggregation and evaluation periods', 'Review a relevant high percentile latency metric instead of only the mean' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When several storage accounts share a metric chart but only one shows elevated transaction errors, the action 'Filter or split by the relevant resource and metric dimension' can be relevant: aggregating multiple accounts can hide which resource produces the error signal. For the different problem of most requests are fast but a small subset exceeds the latency SLA; average latency looks normal, 'Filter or split by the relevant resource and metric dimension' misses the mechanism that percentiles expose tail latency hidden by a low average and should use comparable sample windows. Choosing 'Filter or split by the relevant resource and metric dimension' would address that other need, whereas 'Review a relevant high percentile latency metric instead of only the mean' is intended to solve the stated condition.

'Choose sustained aggregation and evaluation windows for the CPU metric' applies to a different feature boundary because time grain and aggregation determine whether transient peaks satisfy the alert condition. In the stated scenario where most requests are fast but a small subset exceeds the latency SLA; average latency looks normal, 'Choose sustained aggregation and evaluation windows for the CPU metric' does not satisfy the mechanism that percentiles expose tail latency hidden by a low average and should use comparable sample windows. The necessary action is 'Review a relevant high percentile latency metric instead of only the mean', which should be checked against this Azure resource's actual permissions and state.

When several storage accounts share a metric chart but only one shows elevated transaction errors, the action 'Filter or split by the relevant resource and metric dimension' can be relevant: aggregating multiple accounts can hide which resource produces the error signal. For the different problem of a dashboard shows no CPU metric for a VM newly selected in the wrong subscription scope, 'Filter or split by the relevant resource and metric dimension' misses the mechanism that missing chart data may reflect query scope rather than zero CPU load. Choosing 'Filter or split by the relevant resource and metric dimension' would address that other need, whereas 'Verify resource selection, scope and availability of the particular metric' is intended to solve the stated condition.

'Choose sustained aggregation and evaluation windows for the CPU metric' applies to a different feature boundary because time grain and aggregation determine whether transient peaks satisfy the alert condition. In the stated scenario where a dashboard shows no CPU metric for a VM newly selected in the wrong subscription scope, 'Choose sustained aggregation and evaluation windows for the CPU metric' does not satisfy the mechanism that missing chart data may reflect query scope rather than zero CPU load. The necessary action is 'Verify resource selection, scope and availability of the particular metric', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use an Azure Monitor platform metric with suitable time grain' is associated with this separate need: operations want an alert within minutes of VM CPU over 90%, but a colleague suggests parsing one-day-old security logs. That is because platform metrics suit near-real-time numeric thresholds; logs are for queryable events and detail. Here a dashboard shows no CPU metric for a VM newly selected in the wrong subscription scope, so 'Use an Azure Monitor platform metric with suitable time grain' misses the fact that missing chart data may reflect query scope rather than zero CPU load. 'Verify resource selection, scope and availability of the particular metric' is the more defensible action; confirm its behavior in the target service before calling the task complete.

The nearby action 'Verify collection timestamps and fresh telemetry arrival' is associated with this separate need: an Insights dashboard shows yesterday's healthy state after today's failed deployment. That is because a stale visualization is not current evidence that a workload recovered. Here CPU peaks began near a deployment, and an engineer asserts the deployment caused them, so 'Verify collection timestamps and fresh telemetry arrival' misses the fact that temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. 'Correlate deployment events with workload metrics and test alternative causes' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Choose sustained aggregation and evaluation windows for the CPU metric' solves another task because time grain and aggregation determine whether transient peaks satisfy the alert condition. For the situation where CPU peaks began near a deployment, and an engineer asserts the deployment caused them, this distractor misses the requirement that temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. Unlike 'Choose sustained aggregation and evaluation windows for the CPU metric', 'Correlate deployment events with workload metrics and test alternative causes' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When operations want an alert within minutes of VM CPU over 90%, but a colleague suggests parsing one-day-old security logs, the action 'Use an Azure Monitor platform metric with suitable time grain' can be relevant: platform metrics suit near-real-time numeric thresholds; logs are for queryable events and detail. For the different problem of CPU peaks began near a deployment, and an engineer asserts the deployment caused them, 'Use an Azure Monitor platform metric with suitable time grain' misses the mechanism that temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. Choosing 'Use an Azure Monitor platform metric with suitable time grain' would address that other need, whereas 'Correlate deployment events with workload metrics and test alternative causes' is intended to solve the stated condition.