Microsoft AZ-104 Based on Real Exam Environment

Azure Load Balancers are offered in two SKUs — Basic and Standard — each with distinct capabilities, scalability, and configuration requirements as documented in Microsoft Azure Administrator documentation.

LB1 – Basic Load Balancer (Basic SKU)The Basic Load Balancer is designed for small-scale, non-production workloads. It has certain limitations compared to the Standard SKU:

The backend pool of a Basic Load Balancer can only include virtual machines in a single availability set or a single virtual machine scale set.

This restriction ensures that the Basic Load Balancer maintains consistency and proper failover across VMs sharing the same availability set or scale set.

It cannot span multiple availability sets or virtual networks.

Therefore, to load balance VMs using a Basic Load Balancer, those VMs must be created in the same availability set or virtual machine scale set.

✅ Correct Option for LB1: be created in the same availability set or virtual machine scale set.

LB2 – Standard Load Balancer (Standard SKU)The Standard Load Balancer is designed for production-grade workloads and supports advanced features such as zone redundancy, secure by default configuration, and high scalability.

It supports backend pools composed of virtual machines from different availability zones (in the same region) and multiple virtual machine scale sets.

The only requirement is that all backend virtual machines must be connected to the same virtual network.

Standard Load Balancer also supports both public and internal load balancing and provides richer metrics and diagnostic capabilities.

Therefore, for LB2 (Standard), the virtual machines only need to reside within the same virtual network, regardless of their availability sets or zones.

✅ Correct Option for LB2: be connected to the same virtual network.

Microsoft Azure Official Extract (summarized):

“For Basic Load Balancer, backend pool VMs must belong to the same availability set or virtual machine scale set. For Standard Load Balancer, backend pool members can be across availability zones and scale sets, but must be connected to the same virtual network.”

(From Microsoft Azure Administrator Study Guide – Load Balancer Configuration and Comparison; Azure Docs: azure.microsoft.com > Load Balancer SKUs Comparison.)

Final Verified Answer:

✅ LB1: be created in the same availability set or virtual machine scale set

✅ LB2: be connected to the same virtual network

No, No, No

Comprehensive and Detailed 150 to 250 words of Explanation From [Microsoft Azure Administrator/Course Guide/topics]:

Policy1 is assigned only to RG1 , with no exclusions. VM1 is in RG2 , so it is outside the assignment scope and is not within the scope of Policy1. Microsoft’s Azure Policy guidance states that the policy rule determines which resources in the assignment scope are evaluated.

User1 has the Owner role at the subscription scope, which normally grants full management access, including access to resources under RG1. However, Template2 deploys a VM with 192 GB RAM to RG1. Because Policy1 denies deployment of virtual machines with more than 128 GB of RAM, the request is blocked even for an Owner. Microsoft defines the Deny effect as preventing a noncompliant resource request and failing the request.

User2 has Contributor only on RG1 . Template1 deploys the VM into RG1 and uses only 64 GB RAM, so Policy1 does not deny it. However, Template1 connects the VM to VNet2 , which is in RG2 . User2 has no permissions on RG2 or VNet2, so the deployment cannot complete. Study Guide reference: AZ-104 Manage Azure identities and governance , including Azure RBAC, role scope, and Azure Policy.

In this scenario, the PowerShell output shows the configuration of VNet1 in the West US region under the resource group Production. The AddressSpace for the virtual network is defined as 10.2.0.0/16, with a single existing subnet named default that has an AddressPrefix of 10.2.0.0/24.

According to Microsoft Azure networking documentation, an Azure virtual network (VNet) defines an address space (CIDR block), which represents the range of IP addresses available within that network. Subnets are created within that address space to allocate smaller IP ranges for specific resource groupings, such as VMs or application tiers.

For a VM to receive an IP address from 192.168.1.0/24, that range does not exist within the current VNet’s address space (10.2.0.0/16). Therefore, before a VM can use that IP range, you must add an additional address space (192.168.1.0/24) to VNet1.

For a VM to receive an IP address from 10.2.1.0/24, that range falls within the existing address space (10.2.0.0/16). However, there is no subnet currently defined for 10.2.1.0/24, so you must add a new subnet with that address prefix.

This configuration follows the official Azure documentation guidance:

“Each subnet must represent a subset of the virtual network’s address space. To use a different IP range, you must first expand the VNet’s address space before defining subnets within it.”

✅ Final Verified Answer:

192.168.1.0/24 → Add an address space

10.2.1.0/24 → Add a subnet

This question tests understanding of Azure Load Balancer SKU compatibility and backend pool configuration requirements.

???? Scenario Summary

You have:

VM1 and VM2 in the same VNet (VNET1)

A Load Balancer (LB1) configured as:

Type: Internal

SKU: Standard

You need to ensure that VM1 and VM2 can be added to LB1’s backend pool.

The proposed solution:

" You create two Standard public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual machine. "

???? Understanding Azure Load Balancer Requirements

1. Backend pool requirements for a Standard Load Balancer:

All VMs must be in the same virtual network as the load balancer.

Each VM’s NIC must be configured with a Standard SKU IP configuration (private or public).

The Load Balancer SKU must match the SKU of the IP addresses associated with the VM network interfaces.

2. Internal Load Balancer behavior:

An Internal Load Balancer (ILB) distributes traffic within a virtual network using private IP addresses, not public IPs.

Therefore, the backend VMs do not need public IPs — and adding them does not affect backend pool membership.

3. SKU alignment rule (Microsoft Docs):

“You can only attach virtual machines or instances that use Standard IP configurations to a Standard Load Balancer. Basic and Standard SKUs are not interchangeable.”

However:

A public IP is only required for inbound Internet access or outbound NAT, not for internal load balancing.

For an Internal Standard Load Balancer, backend pool members require Standard SKU NIC configurations, not public IPs.

???? Why the Proposed Solution Fails

The solution suggests creating two Standard public IPs and assigning them to the VMs’ NICs.

This does not enable VM1 and VM2 to join the backend pool of an internal load balancer, because:

The load balancer type is internal, meaning it routes private traffic within the virtual network, not via public IPs.

Backend pool membership depends on the NIC’s private IP configuration, not its public IP.

Adding public IPs only exposes VMs to the Internet and does not influence load balancer backend eligibility.

Thus, this action is unnecessary and does not meet the goal.

✅ Correct Solution (for reference)

To meet the goal:

Ensure VM1 and VM2 have NICs configured with Standard SKU private IPs.

Ensure both VMs are in VNet1, the same virtual network as LB1.

No need to assign public IPs to internal backend VMs.

You could also ensure:

az network nic ip-config update \

--name ipconfig1 \

--nic-name VM1-nic \

--resource-group RG1 \

--private-ip-address-version IPv4 \

--sku Standard

✅ Final Verified Answer:

B. No

???? Microsoft Azure Documentation (Exam-Verified Extracts)

Azure Load Balancer SKU Comparison:

“Internal Load Balancer uses private IP addresses. Public IPs are not required or used for internal balancing.”

Backend Pool Membership:

“Virtual machines in the backend pool must be in the same virtual network as the load balancer and use matching Standard SKU IP configurations.”

Public vs Internal Load Balancer:

“For internal load balancers, only private frontends and backend configurations are supported.”

✅ Final Verified Answer: B. No

Assigning Standard public IPs to VMs does not affect internal load balancer backend connectivity. Backend membership depends on private IP configurations in the same VNet and matching SKU, not public IPs.