Examkin

Question

Difficulty: HardDesign Traffic Routing and Failover Strategies

A financial technology enterprise is designing a global, multi-region traffic routing and failover solution for its payment processing platform deployed in the East US 2 and West Europe regions. The solution must accommodate the following incoming traffic streams:

* Stream 1: HTTPS-based web API traffic requiring SSL termination at the network edge, path-based routing (routing `/charge` and `/refund` requests to different backend pools), and integrated Web Application Firewall (WAF) protection.
* Stream 2: A proprietary, latency-sensitive TCP-based client application communicating over port 90909090. This stream does not support HTTP encapsulation and must be routed to the closest healthy regional endpoint.

Which traffic routing configuration should you recommend to meet these requirements?

  1. A
    Deploy Azure Traffic Manager to route both Stream 1 and Stream 2 globally.
  2. Deploy Azure Front Door to route Stream 1, and configure Azure Traffic Manager to route Stream 2 to regional Standard Load Balancers.Answer
  3. C
    Deploy Azure Front Door to route both Stream 1 and Stream 2 globally.
  4. D
    Deploy Azure Application Gateway to perform global path-based routing and failover for both Stream 1 and Stream 2.

Answer

Deploy Azure Front Door to route Stream 1, and configure Azure Traffic Manager to route Stream 2 to regional Standard Load Balancers.
The correct configuration uses Azure Front Door for the HTTPS-based web API traffic (Stream 1) because Front Door provides global Anycast routing, SSL offloading at the edge, path-based routing, and integrated Web Application Firewall capabilities. For the proprietary TCP-based traffic on port 90909090 (Stream 2), Azure Traffic Manager is the appropriate choice because it works at the DNS layer and is protocol-independent. Traffic Manager resolves DNS queries to the IP address of the closest healthy regional Standard Load Balancer, allowing direct TCP connections over port 90909090 without trying to proxy the traffic through an HTTP-only service.

Step-by-Step Solution

1
Analyze the protocols and routing requirements of Stream 1.
Stream 1 requires HTTPS, SSL termination, WAF, and URL-path routing. This requires a global Layer 7 load balancer.
Only Layer 7 load balancers can inspect the URI path, handle SSL offloading, and apply WAF rules.
2
Select the appropriate service for Stream 1.
Azure Front Door is selected.
Azure Front Door is a global Anycast-based Layer 7 service matching all requirements for Stream 1.
3
Analyze the protocol and routing requirements of Stream 2.
Stream 2 requires custom TCP on port 90909090 with low-latency global routing to regional endpoints.
Since the protocol is non-HTTP TCP, a Layer 7 global routing solution like Azure Front Door cannot be used.
4
Select the appropriate service for Stream 2.
Azure Traffic Manager is selected to resolve DNS requests to regional Standard Load Balancers.
Azure Traffic Manager operates at the DNS level, making it protocol-independent, allowing it to route clients to regional public IPs hosting the TCP service on port 90909090.

Key Concept

Selecting and combining global Azure load balancing services based on layer-specific capabilities (Layer 4 vs. Layer 7) and protocol limitations.
Estimated Time:2m 30s
Rate this question

Topics

Design Traffic Routing and Failover Strategies

More questions from this topic