AZ-700 Question 183
Single answerYou manage an Azure environment that hosts a public load balancer with a back-end pool of two Windows Server VMs. You want to allow direct RDP access from the Internet to each VM, but you do not want to expose the default RDP port (3389) on the public load balancer. You plan to create inbound NAT rules so that RDP connections to ports 5000 and 5001 on the load balancer� public IP will map to port 3389 on each VM, respectively. How should you implement this configuration?
- A
Create a single inbound NAT rule that maps a range of ports (5000-5001) to port 3389 in the back-end pool.
- B
Create two separate inbound NAT rules, each specifying a unique front-end port (5000 or 5001) that maps to port 3389 on the target VM.
- C
Enable load balancer session persistence, which automatically translates connections on ports 5000 and 5001 to port 3389 without separate NAT rules.
- D
Configure a custom probe on port 3389 and set the load balancer to automatically forward RDP requests to each VM without using inbound NAT rules.
Show answer and explanation
Correct answer: B
Explanation
When using inbound NAT rules on an Azure Load Balancer, you must create separate rules for each VM if you want to map different external ports to the same internal port (3389 for RDP). Each rule explicitly associates a front-end IP/port combination with a specific back-end VM port. This configuration allows multiple VMs to share the same load balancer while preserving unique front-end ports for management. See the official Microsoft documentation at https://learn.microsoft.com/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal for detailed steps and best practices.
- A. Incorrect.
Incorrect. You cannot map multiple target ports within a single inbound NAT rule by specifying a port range. Each NAT rule maps one external port to one internal port for one VM.
- B. Correct.
Correct. Each VM needs its own inbound NAT rule. For each rule, you map a front-end port (e.g., 5000 or 5001) to the default RDP port (3389) on a specific VM, creating two separate entries.
- C. Incorrect.
Incorrect. Session persistence settings (such as Client IP) in the load balancer do not replace the need for inbound NAT rules. They only influence how subsequent packets from the same client are routed.
- D. Incorrect.
Incorrect. Health probes determine the availability of a VM for load balancing; they do not replace the requirement for binding distinct external ports to port 3389 on the individual VMs.