Cram sheet — Configure name resolution and load balancing

Only three objectives, but forty-eight bank questions — the densest topic per objective in the whole exam. Both halves have a retirement that invalidates older material.

Azure DNS: public and private are different services

• Azure Public DNS hosts DNS domains, managed with the same credentials, APIs, tools and billing as the rest of Azure.
• Azure Private DNS resolves inside virtual networks. ⚠ To resolve a private zone's records from a virtual network you must link the network to the zone. Without a virtual network link, nothing resolves — the zone existing is not enough.
• Autoregistration on a link registers VMs in the zone as A records automatically, and removes them when the VM is deleted.
• ⚠ A virtual network can be linked to only one private zone with autoregistration enabled — though many virtual networks can link to a single zone.

Load Balancer

• Layer 4, TCP and UDP. It is the single point of contact for clients and distributes inbound flows to a backend pool according to load-balancing rules and health probes.
• ⚠ Basic Load Balancer was retired on 30 September 2025. The current SKUs are Standard and Gateway. Anything offering Basic is describing a retired product.
• Public load balancer for internet-facing traffic; internal load balancer for private traffic within a virtual network. The distinction is the frontend, not the backend.
• Backend pool members are VMs or scale sets.

Troubleshooting load balancing

A failure here is almost always one of three things, and they are distinguishable:

1. The probe fails — the instance is out of rotation, so the rule never sends it a flow. The symptom is a healthy-looking VM receiving nothing.
2. A filter blocks it — a security rule denies the probe or the data path.
3. The rule is wrong — wrong port, wrong backend pool, wrong frontend.

Because distribution depends on rules and health probes together, a probe question and a rule question look alike in the stem and have different answers.

Traps

Check yourself

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.