Examkin

Question

Difficulty: MediumDesign Traffic Routing and Failover Strategies

An organization is designing a disaster recovery strategy for a web-based portal hosted in the West Europe and North Europe regions. The solution must support SSL/TLS offloading at the routing layer to reduce decryption overhead on the backend web servers, and it must achieve the lowest possible recovery time objective (RTO) for traffic redirection during a regional failover. Which routing service and configuration should you recommend?

  1. A
    Azure Traffic Manager, because it uses DNS-based routing to resolve client queries to the healthiest regional IP, offloads SSL/TLS at the DNS level, and offers a low TTL to minimize failover time.
  2. B
    Azure Front Door, because it operates at Layer 4 to distribute non-HTTP traffic globally, offloads SSL/TLS encryption, and relies on DNS updates to route around regional failures.
  3. Azure Front Door, because it uses Anycast routing to terminate SSL/TLS at the edge and immediately redirects client traffic to the healthy region without relying on client DNS cache updates.Answer
  4. D
    Azure Traffic Manager combined with Azure Application Gateway in each region, because Traffic Manager offloads SSL/TLS for all inbound requests and performs path-based routing to the regional Application Gateways.

Answer

Azure Front Door, because it uses Anycast routing to terminate SSL/TLS at the edge and immediately redirects client traffic to the healthy region without relying on client DNS cache updates.
The correct choice is the option that recommends Azure Front Door for SSL/TLS termination and edge-based failover. Azure Front Door utilizes Anycast routing to direct client traffic to the nearest Point of Presence (PoP), where SSL/TLS handshakes are completed (offloading decryption from backend servers). Because it routes traffic at Layer 7 and uses split-TCP, it detects backend failures via health probes and immediately diverts traffic to the healthy region at the network level, avoiding the latency associated with DNS client caching and TTL expiration.

Step-by-Step Solution

1
Analyze the requirements for global traffic routing, SSL/TLS offloading, and low failover recovery time objective (RTO).
Identified that the solution must handle global routing, terminate SSL sessions at the network edge, and bypass DNS-based replication delays during failover.
Establishing clear design criteria allows for the elimination of solutions that fail to meet these requirements.
2
Evaluate Azure Traffic Manager against the SSL offloading and RTO requirements.
Determined that Azure Traffic Manager is a DNS-based service that does not intercept HTTP traffic, meaning it cannot offload SSL/TLS. Furthermore, its failover speed is limited by client-side DNS caching and TTL settings.
DNS-based failover is not instantaneous and does not support Layer 7 application features like SSL termination.
3
Evaluate Azure Front Door against the requirements.
Confirmed that Azure Front Door is an Anycast-based Layer 7 service that terminates SSL/TLS closer to the user (at edge PoPs) and handles failover at the network level rather than relying on DNS TTL expiration, enabling near-instantaneous failover.
Anycast routing and edge-termination support both the security offloading and fast-failover requirements.

Key Concept

Anycast-based Layer 7 routing (Azure Front Door) vs DNS-based routing (Azure Traffic Manager) for global load balancing and disaster recovery.
Estimated Time:1m 30s
Rate this question

Topics

Design Traffic Routing and Failover Strategies

More questions from this topic