Task 4.3: Configure name resolution and load balancing

• AAn alias record set in the zone that targets VNet-Dev

  Incorrect

  An alias record set is a single record set that you create yourself; it doesn't add records as VMs are created.

• BA conditional forwarder on the VMs' DNS settings

  Incorrect

  Forwarders send queries elsewhere; they don't register VM names in the zone.

• CA DNS private resolver inbound endpoint in VNet-Dev

  Incorrect

  A resolver endpoint handles hybrid DNS queries; it doesn't register VM records.

• DEnable auto registration on the virtual network link

  Correct

  With autoregistration on the link, Azure creates and maintains a record for each VM in the virtual network.

Autoregistration is a property of the virtual network link. It works for virtual machines only and creates and removes their records as VMs come and go.

• AThe NSG blocks the probe source, tagged AzureLoadBalancer

  Correct

  Probes come from 168.63.129.16, which the AzureLoadBalancer tag stands for. The new deny at priority 100 is evaluated before the default AllowAzureLoadBalancerInBound rule at 65001, so the probes are dropped.

• BStandard load balancers need HTTP probes on port 80

  Incorrect

  TCP probes on any port are supported; the app responds on 8080, so the probe type isn't the problem.

• CInternal load balancers need a public IP on each backend VM

  Incorrect

  Backends of an internal load balancer use private addresses; public IPs aren't required.

• DThe backend VMs need to be in an availability set

  Incorrect

  Standard Load Balancer backends can be any VMs in the virtual network; no availability set is needed.

The probe source address 168.63.129.16 must be allowed by every NSG and local firewall. The default AllowAzureLoadBalancerInBound rule allows it, but NSG rules are processed in priority order and processing stops at the first match, so a deny from Any at a lower number wins and the load balancer marks the instances down. An allow rule for the AzureLoadBalancer tag above the deny fixes it.

• AA CNAME record set at @ pointing to the public IP's DNS name

  Incorrect

  You can't create a CNAME at the zone apex, because the apex already holds the NS and SOA record sets.

• BAn NS record set at @ pointing to the VM

  Incorrect

  The apex NS record set lists the zone's name servers; it can't point a name at a VM.

• CAn alias A record set at @ that targets the public IP

  Correct

  An alias A record references the public IP resource and updates when the address changes, and it's allowed at the apex.

• DA TXT record set at @ that contains the public IP address

  Incorrect

  A TXT record stores text; resolvers don't use it to return an address.

The DNS standards don't let a CNAME share a name with other records, and the apex always has NS and SOA records. An alias A record set can point at a Standard public IP resource and stays in step with it.

• ACreate a Standard load balancer instead

  Correct

  Standard is the supported SKU, with zone redundancy and a closed-by-default security model.

• BUse Application Gateway, since load balancers are retired

  Incorrect

  Only the Basic SKU is retired; Standard Load Balancer is current.

• CNothing; Basic remains the default for new deployments

  Incorrect

  Basic Load Balancer was retired on 30 September 2025.

• DUse a Gateway load balancer for the app

  Incorrect

  Gateway load balancers chain appliances; they aren't a general replacement.

Basic Load Balancer was retired on 30 September 2025. Use Standard Load Balancer, which needs NSGs to allow traffic to its backends.

• AHTTP probes accept 2xx and 3xx responses

  Incorrect

  A probe is up only for status 200.

• BAn HTTP probe needs a 200 response

  Correct

  Any status other than 200 marks the probe down.

• CThe probe's port must be 80

  Incorrect

  Probes can use any port.

• DHTTP probes need HTTPS

  Incorrect

  HTTP probes work over HTTP.

HTTP and HTTPS probes mark an instance up on a 200 response within the timeout; any other status code marks it down. Point the probe at a path that returns 200 without sign-in.

• AAn outbound rule for port 22

  Incorrect

  Outbound rules handle outbound SNAT.

• BInbound NAT rules for each VM's port 22

  Correct

  Inbound NAT rules forward a frontend port to a specific backend instance's port.

• CSession persistence on port 22

  Incorrect

  Persistence can't target a particular VM.

• DA load balancing rule for port 22 on the frontend

  Incorrect

  A load balancing rule spreads connections across the pool, not to a chosen VM.

Inbound NAT rules provide port forwarding through the load balancer's frontend to individual instances. Bastion is often a safer way to reach VMs.

• AEnable gateway transit on the peering

  Incorrect

  Gateway transit lets the spoke use the hub's VPN or ExpressRoute gateway; it doesn't make the hub's private zones resolvable.

• BAdd a second link from corp.internal to VNet-Hub for the spoke

  Incorrect

  Only one link can exist between a zone and a virtual network, and a link serves the VMs in the network it names.

• CLink corp.internal to VNet-Spoke as well

  Correct

  A virtual network resolves a private zone's records only once it's linked to the zone; peering doesn't extend the hub's link.

• DMove corp.internal to VNet-Spoke's region

  Incorrect

  A private zone is stored as a global resource and can be linked to virtual networks in any region; its location isn't the problem.

To resolve a private DNS zone from a virtual network, that network must be linked to the zone. In a hub-and-spoke design each spoke gets its own link, and resolution across linked networks doesn't depend on peering at all.