Get Your CertAZ-104PlayCompete
‹ All AZ-104 questions

AZ-104 Practice Question 28: Load Balancer Probe NSG

Microsoft Azure Administrator Associate (AZ-104) · Test 3 · question 8 of 10

Virtual Networkingmedium

A Standard public load balancer fronts three VMs in the subnet snet-web. The portal reports every backend instance as unhealthy and clients get no response.

From a jump box in the same virtual network you can open the site on each VM's private IP over port 80, and the web service is running on all three. A colleague recently tightened the subnet's network security group by adding an inbound rule at priority 100 that denies everything except traffic sourced from the virtual network address space.

What should you do?

Select one answer
Show answer and explanation

Answer:

  • B. Add an inbound rule that allows the AzureLoadBalancer service tag on the probe port at a priority lower than 100

Health probes do not come from the frontend IP or from the virtual network: "all IPv4 Load Balancer health probes originate from the IP address 168.63.129.16 as their source," and "for Azure Load Balancer's health probe to mark up your instance, you must allow 168.63.129.16 IP address in any Azure network security groups and local firewall policies." The colleague's rule denies everything that is not sourced from the VNet, so the probes are dropped, every instance is marked down, and "when all instances probe down ... no new flows are sent to the backend pool." The AzureLoadBalancer service tag "identifies this source IP address in your network security groups," and a lower priority number than 100 makes the allow rule match first.

Option A opens the subnet to the internet and still does not fix the probe path, because the probe's source is the platform address, not an internet address or the frontend IP.

Option C changes nothing about filtering. NSG rules match on source, destination, port, and protocol (TCP/UDP); an HTTPS probe is still a TCP flow from 168.63.129.16 and is denied by the same rule. Microsoft also warns that blocking the probe IP or port with NSG rules is unsupported.

Option D is unnecessary and wrong for a Standard load balancer, whose backend pool is populated with the VMs' NIC IP configurations. Public IPs on the VMs would not change where probes originate.

Reference: Azure Load Balancer health probes

Practice Test 3 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.
AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.
Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.
Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.
Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.