AZ-104 Question 240
Single answerYou manage an Azure environment hosting a multi-tier application. The web front-end VMs reside in a public subnet with a public IP address, while the application servers are in a private subnet. You need to configure an Azure Load Balancer so that traffic from the web front-end is distributed to the application servers without exposing them publicly. Which step is required to properly configure an internal load balancer in this scenario?
- A
Enable a public IP address on the load balancer to attract all inbound traffic and then route it to the private subnet
- B
Configure a private IP address for the load balancer frontend in the same subnet as the application servers
- C
Use an outbound rule in the load balancer to map public ports directly to the private subnet
- D
Place the load balancer in a different virtual network than the web front-end and create VNet peering connections
Show answer and explanation
Correct answer: B
Explanation
In this scenario, an internal load balancer requires a private IP address in the same subnet as the backend application VMs to ensure traffic is routed internally and remains private. Option 2 is correct because it allows the web front-end VMs to distribute traffic to the private application VMs without exposing them to the public internet.
- A. Incorrect.
Enabling a public IP address contradicts the goal of keeping the application servers internal and accessible only from the web tier within the private network
- B. Correct.
Configuring a private IP address for the load balancer frontend in the same subnet as the backend VMs is essential for an internal load balancer, allowing private traffic flow
- C. Incorrect.
An outbound rule is used for outbound connections; it does not address the requirement for distributing internal traffic to private VMs
- D. Incorrect.
Placing the load balancer in a different virtual network than the web app complicates subnet routing; it is not required and would not serve the scenario described