exam questions

Exam AZ-303 All Questions

View all questions & answers for the AZ-303 exam

Exam AZ-303 topic 2 question 31 discussion

Actual exam question from Microsoft's AZ-303
Question #: 31
Topic #: 2
[All AZ-303 Questions]

You have 10 Azure virtual machines on a subnet named Subnet1. Subnet1 is on a virtual network named VNet1.
You plan to deploy a public Azure Standard Load Balancer named LB1 to the same Azure region as the 10 virtual machines.
You need to ensure that traffic from all the virtual machines to the internet flows through LB1. The solution must prevent the virtual machines from being accessible on the internet.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

  • A. Add health probes to LB1.
  • B. Add the network interfaces of the virtual machines to the backend pool of LB1.
  • C. Add an inbound rule to LB1.
  • D. Add an outbound rule to LB1.
  • E. Associate a network security group (NSG) to Subnet1.
  • F. Associate a user-defined route to Subnet1.
Show Suggested Answer Hide Answer
Suggested Answer: BDE 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
andyR
Highly Voted 4 years, 9 months ago
BDE https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections
upvoted 67 times
Gch
3 years, 5 months ago
NSG is never associated with a subnet , rather associated with VNIC , so AB and D is correct.
upvoted 3 times
china5000
3 years, 5 months ago
Read this: https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group
upvoted 1 times
MalonJay
3 years, 4 months ago
For load balancer the NSG is not associated to the subnet.
upvoted 1 times
...
...
...
J4U
3 years, 8 months ago
Correct: BDE Health probes aren't required for outbound only connections. Also NSG is required to restrict the outbound connection. https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview
upvoted 1 times
...
cloudcuckooland
4 years, 9 months ago
I'd agree with this, BDE. B and D are 100% correct and need no explanation. Reason: I've tested in the lab and a health probe is not needed to ensure flow of data, in fact for a standard load balancer even if probes are down connections will continue to flow. Answer C is clearly wrong and not needed or expected. Answer F is also not needed, outward connections work without a UDR. This leaves E as the only sensible remaining answer, add and NSG to block any incoming traffic, although, in my testing I can't connect to the VMs as the default rules block access.
upvoted 21 times
rdemontis
3 years, 10 months ago
I think you are right. The reason why you should use an NSG is to block the outbound traffic for VMs (not the inbound that's already blocked by default) because they have to go on internet only through the LB1. In fact the default nsg outbound rule for VMs allows internet access! So you have to prevent this.
upvoted 2 times
rdemontis
3 years, 10 months ago
Just to clarify Health Probes: they are foundamentals for Internet to LB traffic but this is not the case https://docs.microsoft.com/en-us/azure/load-balancer/outbound-rules
upvoted 1 times
rdemontis
3 years, 10 months ago
I'd like to corrrect last message. Health probe are always a recommended practice but in this case the question points out about internet traffic flow from the VMs through the LB. And because you have to use a Standard Load balancer you don't need them. instead you need to associate NIC to LB Backend Pool and an Outbound rule for internet access https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections#outboundrules
upvoted 2 times
...
...
gizda2
3 years, 7 months ago
also, they don't say anything about public IPs being assigned to the VMs. How the hell they would be accessible from the net then. yet another badly phrased question.
upvoted 1 times
...
...
...
...
JulienYork
Highly Voted 4 years, 7 months ago
BDE will be correct. A is wrong You need Health Probe when you have inbound connection B is correct you have to provide the pool members C is wrong You do not need any inbound traffic D is correct you need to allow for outbound traffic E is Correct You need to manage the traffic. F is wrong Route can be assigned for a target through internet, VirtAppliance, VNet Also, check this below https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections
upvoted 31 times
...
itvinoth83
Most Recent 3 years, 1 month ago
Appeared in exam on 28-03-2022
upvoted 1 times
...
sandeepmalik
3 years, 1 month ago
In today's exam. Score 900+ Correct answer. BDE
upvoted 1 times
...
kanweng
3 years, 1 month ago
I have configured in my lab, B and D is enough for all the virtual machines to the internet flows through LB1, no Inbound NAT rule that will prevent the VM being accessible on the internet. if we have to choose another one, only E makes sense. (but not necessary), (I have not use any NSC for my lab setup, no NSG for subnet, nor VM NIC). E (NSG) also prevent someone configure Inbound NAT for the VM, this will prevent access from internet, even inbound NAT is configured. You can test the above with bastion host to the VM. A, C, E (will certainly apply for inbound flow load balancing). A Add health probes to LB1. only apply to inbound flow. https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview Generate a custom response to a health probe. Use the health probe for flow control to manage load or planned downtime. When a health probe fails, the load balancer will stop sending new connections to the respective unhealthy instance. Outbound connectivity isn't affected, only inbound.
upvoted 1 times
...
justfordevelopment
3 years, 2 months ago
In the exam on 12-03-2022. Total 50 questions including case study. "Litware Acquired Fabricam" case study.
upvoted 1 times
...
santoshm_75
3 years, 2 months ago
Standard load balancers and standard public IP addresses are closed to inbound connections unless opened by Network Security Groups..So NSG is required but health probe can be optional
upvoted 1 times
...
shree178
3 years, 3 months ago
On exam today 19-2-2022.. Passed with 871.
upvoted 2 times
srindu
3 years, 2 months ago
what answers you selected?
upvoted 1 times
...
...
Choquito
3 years, 3 months ago
Selected Answer: ABC
https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-portal?tabs=option-1-create-load-balancer-standard
upvoted 1 times
...
Choquito
3 years, 3 months ago
ABC is the answer. to create a standard load balancer we need to set up the health probe, create the pool and create an inbound balancing rule https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-portal?tabs=option-1-create-load-balancer-standard
upvoted 2 times
...
nd78
3 years, 4 months ago
on Exam today 21st Jan, 2022
upvoted 1 times
srindu
3 years, 2 months ago
which answers you selected?
upvoted 1 times
...
...
GaeBer
3 years, 4 months ago
Selected Answer: BDE
I think BDE
upvoted 1 times
...
Dileep75
3 years, 4 months ago
i would go with the given answers
upvoted 1 times
...
valgaw
3 years, 4 months ago
Selected Answer: BDE
BDE are correct, as expained by cloudcuckooland and andyR
upvoted 2 times
...
ishin999
3 years, 4 months ago
I'd like to put a different perspective on this and answer B D and F. Tried this in a lab...set up LB inc FE config (so gave it a public IP address)...set up B config and added one VM only...added this into the BE of the LB and added outbound rule...so far so good.....then went into VM and checked the effective routing.....sure enough....0.0.0.0 was still via Internet.....I believe that to route Internet outbound via the LB, you have to create a UDR (UDR's are at the subnet level) with 0.0.0.0/0 and put the public IP address of the LB as the next hop....and then associate to the subnet...went back into the VM and checked the effective route.....0.0.0.0 via LB....could be wrong though...just my logic.
upvoted 4 times
...
plmmsg
3 years, 4 months ago
Answer is B, D, E
upvoted 1 times
...
tahaRyski
3 years, 4 months ago
BDE is correct: https://msazure.club/addendum-of-azure-load-balancer-and-nsg-rules/
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...