Exam AZ-103 topic 16 question 10 discussion

Question 31 is here: https://www.examtopics.com/exams/microsoft/az-101/view/17/

Correction : https://www.examtopics.com/exams/microsoft/az-101/view/17/ question 31

You can have a public IP. Answer are chance VM1 to static and create NSG

Explanation 1. (part1): When you create a backend pool on a Standard-SKU Load Balancer you must add at least one VM to the pool (unlike in the Basic-SKU Load Balancer where you could create a backend pool with no VMs listed) but there is no check against NSG of the VMs being added, so the answer "Create and configure an NSG" to the first question is incorrect. The configuration of the Public IP address of the VM is checked instead. This is clearly explained in this message on the "Add backend pool" blade: "Only IP configurations that have the same SKU (Basic/Standard) as the Load Balancer can be selected."

Explanation 1. (part2): Because in the example you must deploy a Standard-SKU load balancer, the VMs with Basic-SKU Public IP configurations will not be accepted (they don't even show up on the dropdown list - I just checked it). The dropdown shows only VMs with either Standard SKU Public IP configuration or NO Public IP configuration at all. The important thing is that Standard-SKU Public IP configuration only allows for static IPs (dynamic IPs are not possible with Standard-SKU). In result only VMs with no public IP or Standard-SKU/static IP can be added to the backend pool. So these two answers seem possible: "Remove the public IP address from VM1" and "Change the private IP address of VM1 to static". But if we need to select only 1 correct answer I would go with "Change the private IP address of VM1 to static" (which effextively means removing the current Basic-SKU Public IP address configuration from VM's NIC and adding a Standard-SKU Public IP address configuration which will be static). Because changing the VM's IP to static is possible then removing the public IP from the VM is not a must.

Explanation 2: According to the characteristics of the Standard Load Balancer, the VM has to be secured with NSG for anything to connect to it: "Standard Load Balancer is secure by default. This means Network Security Groups (NSGs) are used to explicitly permit and whitelist allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource. Please configure an NSG to ensure communication if needed."

Correction: 1. "Remove the public IP address from VM1" is the right answer for question 1. It is actually not possible to change SKU of a Public IP configuration, so we would have to remove it. We don't need this IP anyway since we will have a load balander. And even if we plan to add a Standard-SKU Public IP in the future (for example for RDP), which is not mentioned in the question, still removing it is the right answer as it is a required step.

Standard Load Balancer only supports VMs with Standard IP addresses in the backend pool. In this section, you will create three VMs (myVM1, myVM2, and myVM3) with a Standard public IP address in three different zones https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-standard-manage-portal